<![CDATA[OpenID URI configuration issue (for Synapse's MAS)]]>Guess that would be of use to Cloudron as well - I'm configuring MAS now (as a follow up from https://forum.cloudron.io/topic/13140/we-need-the-matrix-authentication-service-mas/9) and I'm facing the following error:

redirect_uri did not match any of the client's registered redirect_uris

I've registered the client cid-ge9eaf52aaff129a8df85b168330e582 with callback URL: https://auth.mydomain.com/upstream/callback/

Decoded URL of the page where I see the error is:
https://my.mydomain.com/openid/auth?response_type=code&client_id=cid-ge9eaf52aaff129a8df85b168330e582&redirect_uri=https://auth.mydomain.com/upstream/callback/02JRTE26ER59ZCVR8P81GHD2V5&scope=email+openid+profile&state=IvtPGE8sYTtD0u1a&nonce=8u6Ijs0z7dDwGriu&code_challenge_method=S256&code_challenge=hnG2HcdLQBrJO3DYUCg3OcapcvYxElAu5AO_28MLpg5

So, redirect_uri == https://auth.mydomain.com/upstream/callback/02JRTE26ER59ZCVR8P81GHD2V5... which looks to be in line with https://auth.mydomain.com/upstream/callback/ that I've registered (and so does client id).

Unless, cloudron expect to see exactly the same URL? If so - is there any quick way to resolve that?
I'm ready to patch some files directly if required, if that would be added in the coming release.

]]>https://forum.cloudron.io/topic/13648/openid-uri-configuration-issue-for-synapse-s-masRSS for NodeSun, 12 Apr 2026 09:26:47 GMTMon, 14 Apr 2025 22:14:44 GMT60<![CDATA[Reply to OpenID URI configuration issue (for Synapse's MAS) on Fri, 13 Mar 2026 12:47:57 GMT]]>We looked into this, created a community app and documented everything here:
https://forum.cloudron.io/topic/15225/matrix-authentication-service

]]>https://forum.cloudron.io/post/121795https://forum.cloudron.io/post/121795Fri, 13 Mar 2026 12:47:57 GMT<![CDATA[Reply to OpenID URI configuration issue (for Synapse's MAS) on Wed, 16 Apr 2025 09:52:24 GMT]]>Negative. Please, disregard what have been said earlier: OpenID from Cloudron could be used as is.

Happy to share my findings on setting up the service with @vladimir.d or whoever will be doing this configuration for everyone on Cloudron.

]]>https://forum.cloudron.io/post/105800https://forum.cloudron.io/post/105800Wed, 16 Apr 2025 09:52:24 GMT<![CDATA[Reply to OpenID URI configuration issue (for Synapse's MAS) on Wed, 16 Apr 2025 08:25:13 GMT]]>From Cloudron manifest file I can see that you use callback as a static rule:

"loginRedirectUri": "/_synapse/client/oidc/callback"

Which is pretty much in line with what I wrote earlier -> Cloudron OpenID component needs improvements in order for Synapse's MAS to work.

]]>https://forum.cloudron.io/post/105794https://forum.cloudron.io/post/105794Wed, 16 Apr 2025 08:25:13 GMT<![CDATA[Reply to OpenID URI configuration issue (for Synapse's MAS) on Wed, 16 Apr 2025 08:22:24 GMT]]>@joseph I believe it's a question of support still - as I'm trying to figure out to configure Cloudron's OpenID to work with external app, which Cloudron is about to repackage on it's own.

The link you've provided - is related to configuring Synapse server, while the issue is with Cloudron's OpenID and the way it handles redirect_uri.

Please, let me know if I shall not expect any reasonable and prompt support on that - if that is the case, I will have to replace the Cloudron functionality as a platform, and for that I will need quite some time.

I would be happy to work with someone from the team however, to keep Cloudron in my perimeter and share everything I will work on, so that you would be able to merge Synapse MAS and Element Call into the platform easily.

]]>https://forum.cloudron.io/post/105792https://forum.cloudron.io/post/105792Wed, 16 Apr 2025 08:22:24 GMT<![CDATA[Reply to OpenID URI configuration issue (for Synapse's MAS) on Wed, 16 Apr 2025 07:12:06 GMT]]>Not an expert on this, I suspect one has to try it out to know what the issue is . But https://git.cloudron.io/packages/synapse-app/-/blob/master/start.sh?ref_type=heads#L73 is how we configure OIDC in the existing synapse and that of course works .

]]>https://forum.cloudron.io/post/105789https://forum.cloudron.io/post/105789Wed, 16 Apr 2025 07:12:06 GMT<![CDATA[Reply to OpenID URI configuration issue (for Synapse's MAS) on Tue, 15 Apr 2025 09:57:33 GMT]]>That looks to be an error produced by oidc-provider module in use of Cloudron (InvalidRedirectUri exception), looks like it is raised by /home/yellowtent/box/src/oidc.js.

oidc-provider module provides information how to use wildcard redirect_uri, warming that is shall not be used in production: https://github.com/panva/node-oidc-provider/blob/main/recipes/redirect_uri_wildcards.md

It looks to me like oidc.js logic has to be altered in a way to let wildcard at the end of the redirect_uri, as otherwise Synapse's MAS won't work.

Unless I'm missing something.

]]>https://forum.cloudron.io/post/105712https://forum.cloudron.io/post/105712Tue, 15 Apr 2025 09:57:33 GMT<![CDATA[Reply to OpenID URI configuration issue (for Synapse's MAS) on Mon, 14 Apr 2025 22:29:56 GMT]]>Element's MAS requirements are as follow:

create an OAuth 2.0/OIDC client on the provider's side, using the following parameters:

  • redirect_uri: https://<auth-service-domain>/upstream/callback/<id>
  • response_type: code
  • response_mode: query
  • grant_type: authorization_code
]]>https://forum.cloudron.io/post/105683https://forum.cloudron.io/post/105683Mon, 14 Apr 2025 22:29:56 GMT