how should I set up OIDC?

[divideableZero]

I have been waiting long time for Tuwunel to support OIDC, because now users can easily register on my homeserver. but I don't understand the right way to set it up.

I tried running my own IDM (Rauthy), but I didn't like it, because users cannot choose a username (Tuwunel then assumes it from email, which is not cool).

then I decided to set up Matrix Authentication Service, but it does not work too, because it works only with Synapse currently. also, it seems that MAS is only for transitional phase: from legacy auth to a new one.

I'm confused and don't understand what should I set up

[jevolk]

Rauthy has to provide specific userinfo claims on registration to choose a user ID. For each claim if it's not set or the user ID isn't available a lower-priority claim is then used. In most software this just means the user setting their identity profile accordingly.

These claims are preferred_username, username, nickname, login, and email. Therefor in this case it seems either only the email was provided or any prior were already registered.

This system can be tweaked in the provider's config section in Tuwunel with the userid_claims array which will be officially documented very very shortly. One other trick is the sub override, which happens if you specifically list "sub" in that config it will be the first choice for user ID's and sub is always provided.

[divideableZero]

thank you very much, Jason. you wrote about preferred_username, which I wasn't aware of before, and it was disabled in my Ruathy config. now everything works as expected.

userid_claims array which will be officially documented very very shortly

I also know from some other discussions that you're working on SSO docs. I could then write about Rauthy