Skip to content

fix(oidc): return M_UNRECOGNIZED when OIDC server is not configured#421

Open
f3nr1l wants to merge 1 commit intomatrix-construct:mainfrom
f3nr1l:fix/auth-metadata-unrecognized
Open

fix(oidc): return M_UNRECOGNIZED when OIDC server is not configured#421
f3nr1l wants to merge 1 commit intomatrix-construct:mainfrom
f3nr1l:fix/auth-metadata-unrecognized

Conversation

@f3nr1l
Copy link
Copy Markdown

@f3nr1l f3nr1l commented Apr 15, 2026

Summary

When OAuth/OIDC is not configured, /_matrix/client/v1/auth_metadata and /_matrix/client/v1/auth_issuer currently propagate the services.oauth.get_server() error as-is, which surfaces to clients as a generic M_NOT_FOUND.

Element Web (>= 1.12, via matrix-js-sdk's buildValidatedConfigFromDiscovery) only treats MSC2965 discovery as "not supported" when it receives 404 + M_UNRECOGNIZED. Any other error — including 404 + M_NOT_FOUND — is treated as a fatal misconfiguration and the login screen shows " is misconfigured".

This PR makes both endpoints return 404 + M_UNRECOGNIZED ("OIDC server not configured") when no OAuth server is configured, matching the behavior of the router's default not_found handler. Password-only homeservers then work out of the box with recent Element Web builds.

Reproduction

  1. Deploy Tuwunel with login_with_password = true and no [[global.identity_provider]] block.
  2. Open the latest Element Web, point it at that homeserver.
  3. Before the patch: login screen stuck on " is misconfigured".
  4. After the patch: login screen shows the password form as expected.

Changes

  • src/api/oidc/auth_metadata.rs — intercept get_server() error, return Error::Request(ErrorKind::Unrecognized, ..., StatusCode::NOT_FOUND).
  • src/api/oidc/auth_issuer.rs — same fix.

Tested on

Built from this branch, deployed on matrix.altanet.fr (Tuwunel 1.6.0 + this patch). Element Web login flow, password auth, federation all nominal. Running for several days without regression.

Notes

  • No change to the happy path when OIDC is configured.
  • No new dependencies.
  • Reference for the expected behavior: the default not_found handler in src/router/router.rs already returns M_UNRECOGNIZED for unknown routes.

`/_matrix/client/v1/auth_metadata` and `/_matrix/client/v1/auth_issuer`
currently propagate the `services.oauth.get_server()` error as-is when
OAuth/OIDC is disabled, which surfaces to clients as a generic
`M_NOT_FOUND`.

Element Web (>= 1.12, via matrix-js-sdk's
`buildValidatedConfigFromDiscovery`) only treats MSC2965 discovery as
"not supported" when it receives `404 + M_UNRECOGNIZED`. Any other
error — including `404 + M_NOT_FOUND` — is treated as a fatal
misconfiguration and the login screen shows "<server> is
misconfigured".

Match the behavior of the router's default `not_found` handler: when
no OAuth server is configured, return
`404 + M_UNRECOGNIZED ("OIDC server not configured")` from both
endpoints. This lets password-only homeservers work out of the box
with recent Element Web builds.
@jevolk jevolk added the bug Something isn't right. label Apr 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't right.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants