Tuwunel Syn2Mas

[xcysy32]

What problem would this solve?

Those old users signed in tuwunel before using the MAS will be able to login by the MAS.
BUT you have to change their password in the tuwunel Admin Room by
users reset-password

What would you like to happen?

You need to able the adminapi of MAS
http:
listeners:
# The name of the listener, used in logs and metrics
- name: web

  # List of resources to serve
  resources:
    # Serves the .well-known/openid-configuration document
    - name: discovery
    # Serves the human-facing pages, such as the login page
    - name: human
    # Serves the OAuth 2.0/OIDC endpoints
    - name: oauth
    # Serves the Matrix C-S API compatibility endpoints
    - name: compat
    # Serve the GraphQL API used by the frontend
    - name: graphql
    # Serve the given folder on the /assets/ path
    - name: assets
      path: ./share/assets/
    # Serve the admin API on the /api/admin/v1/ path. Disabled by default
    #- name: adminapi      ----able it

THEN get the admin token:

1.make the THEUSERNAME admin in the MAS:
mas-cli manage promote-admin THEUSERNAME
2.GET the client_id:
curl -X POST \

https://whereurunMAT/oauth2/registration
-H 'Content-Type: application/json'
-d '{
"client_name":"WHATEVER",
"client_uri":"WHATEVERmaybeurl?",
"grant_types":[
"urn:ietf:params:oauth:grant-type:device_code",
"refresh_token"
],
"application_type":"native",
"token_endpoint_auth_method":"none"
}'
{"client_id":"client_id","client_id_issued_at":1786435874,"redirect_uris":[],"grant_types":["refresh_token","urn:ietf:params:oauth:grant-type:device_code"]," application_type":"native","token_endpoint_auth_method":"none","client_name":"CLI tool","client_uri":"WHATEVERmaybeurl?"}

3. get the device_code

curl -X POST \

https://whereurunMAT/oauth2/device
-d "client_id=Client_id"
-d "scope=openid urn:THEUSERNAME:admin"

{"device_code":"device_code","user_code":"WXUCD4","verification_uri":"https:///link","verification_uri_complete":"https:///link?code=WXUCD4","expires_in":1200,"interval":5}

OPEN THE verification_uri_complete ,LOGIN with THEUSERNAME account

4 get the admin token:
curl -X POST \

https://MAT/oauth2/token
-d "grant_type=urn:ietf:params:oauth:grant-type:device_code"
-d "device_code=device_code!"
-d "client_id=client_id!"
{"access_token":"","refresh_token":"","id_token":"","token_type":"Bearer","expires_in":300,"scope":"openid urn:USERNAME:admin"}

5 use the admin token:
FIRST,access_token will expires_in 300 ,
you can REFESH the token :

curl -X POST
https://auth.xcysy.top/oauth2/token
-d "grant_type=refresh_token"
-d "refresh_token=!refresh_token!"
-d "client_id=!client_id!"

THEN create those old users in MAS:

for u in user1 user2 user3; do
curl -X POST
https://MAT/api/admin/v1/users
-H "Authorization: Bearer !access_token!"
-H "Content-Type: application/json"
-d "{"username":"$u","skip_homeserver_check":true}" _______________IMPORTANT
done

AND SET THE passwd of users
mas-cli manage set-password USER PASSWD

Finally you can login by MAS OR Tell those user whats their PASSWD

Alternatives or workarounds

No response

Related MSC or spec section

No response