The current package uses:

• Synapse v1.144.0 (which is compatible - MAS requires v1.136.0+)
• Cloudron OIDC for SSO (traditional OIDC provider approach)
• PostgreSQL as the database
• Standard Matrix authentication endpoints

What MAS Integration Requires
MAS is fundamentally different from traditional OIDC - it's not just another identity provider, but a complete replacement for Synapse's internal authentication system per MSC3861. It needs:

1. MAS Service Deployment

• MAS needs to run as a separate service (not just a config change)
• It requires its own separate PostgreSQL database
• It needs its own domain/subdomain (e.g., auth.matrix.example.com)
• Docker image: ghcr.io/element-hq/matrix-authentication-service:latest

2. MAS Configuration Requirements

• Encryption secrets and signing keys (RSA minimum)
• Connection to Synapse via shared secret
• Database configuration for its own PostgreSQL database
• HTTP listener configuration
• Email configuration for password recovery
• Policy configuration (WASM file)

3. Synapse Configuration Changes
Replace traditional OIDC with matrix_authentication_service section:

matrix_authentication_service:
  enabled: true
  endpoint: http://mas-internal:8080/
  secret: "SharedSecretWithMAS"

4. Reverse Proxy Changes
These Matrix endpoints must be routed to MAS (not Synapse):

• /_matrix/client/*/login
• /_matrix/client/*/logout
• /_matrix/client/*/refresh

5. User Migration (For Existing Deployments)
MAS includes syn2mas tool to migrate:

• Existing password hashes (bcrypt → argon2id)
• Sessions and devices
• Access tokens
• Upstream IdP mappings

@jdaviescoates @nebulon also attended the matrix talk in FOSDEM and they mentioned MAS is the way forward. It's in our internal task list, let's see when @vladimir.d can get to it.

@ntnsndr FYI I think this is the latest (saw you commented on the related thread about Element X)

I've ejected Synapse from Cloudron and run it independently - it is kind of working (if you don't mind get your hands dirty in the database), but if you don't need Element Calls - I can't see no real benefits.

Not sure if the question was anyhow directed on me, but I hope that rant might be of some use anyway

@jdaviescoates @nebulon also attended the matrix talk in FOSDEM and they mentioned MAS is the way forward. It's in our internal task list, let's see when @vladimir.d can get to it.

Any update on this?

I just realised 1.0.0 was released two days ago!

https://github.com/element-hq/matrix-authentication-service/releases/tag/v1.0.0

BTW, I just noticed that in my Cloudron Dashboard is says "login with dedicated account":

But it's actually using OIDC:

What's going on there?

Either way, I'm hoping we can have MAS soon and that that will make Element X work with my instance

I would appreciate any help here - it would be beneficial for the work to be done by @vladimir.d or whoever would be solving the same task.

I'm quite limited in time to make the transition, guess I will eject the Synapse service to run it separately then: from what I've read, a separate service required to do the MAS and as the works hasn't been started yet, I guess it will take quite some time to make it to the production on Cloudron (understandable to keep things stable).

It's in our internal task list, let's see when @vladimir.d can get to it.

Great! Looking forward to it!

Do you happen to know any official announcement/note from the matrix team? Not sure why this is so obscure.

The best I can offer is a friend who works for Element who told me in a matrix chat:

"They should implement MAS in cloudron. This is the way forward."