# Enable OpenID Connect (OIDC) / OAuth 2.0 for registration and login.
#
# See https://github.com/matrix-org/synapse/blob/master/docs/openid.md
# for some example configurations.
#
oidc_config:
  # Uncomment the following to enable authorization against an OpenID Connect
  # server. Defaults to false.
  #
  enabled: true

  # Uncomment the following to disable use of the OIDC discovery mechanism to
  # discover endpoints. Defaults to true.
  #
  #discover: false

  # the OIDC issuer. Used to validate tokens and (if discovery is enabled) to
  # discover the provider's endpoints.
  #
  # Required if 'enabled' is true.
  #
  issuer: "https://myhost/oidc/"

  # oauth2 client id to use.
  #
  # Required if 'enabled' is true.
  #
  client_id: "matrix"

  # oauth2 client secret to use.
  #
  # Required if 'enabled' is true.
  #
  client_secret: "dontcare"

  # auth method to use when exchanging the token.
  # Valid values are 'client_secret_basic' (default), 'client_secret_post' and
  # 'none'.
  #
  #client_auth_method: client_secret_post

  # list of scopes to request. This should normally include the "openid" scope.
  # Defaults to ["openid"].
  #
  #scopes: ["openid", "profile"]

  # the oauth2 authorization endpoint. Required if provider discovery is disabled.
  #
  #authorization_endpoint: "https://accounts.example.com/oauth2/auth"
  # the oauth2 token endpoint. Required if provider discovery is disabled.
  #
  #token_endpoint: "https://accounts.example.com/oauth2/token"

  # the OIDC userinfo endpoint. Required if discovery is disabled and the
  # "openid" scope is not requested.
  #
  #userinfo_endpoint: "https://accounts.example.com/userinfo"

  # URI where to fetch the JWKS. Required if discovery is disabled and the
  # "openid" scope is used.
  #
  #jwks_uri: "https://accounts.example.com/.well-known/jwks.json"

  # Uncomment to skip metadata verification. Defaults to false.
  #
  # Use this if you are connecting to a provider that is not OpenID Connect
  # compliant.
  # Avoid this in production.
  #
  #skip_verification: true

  # Whether to fetch the user profile from the userinfo endpoint. Valid
  # values are: "auto" or "userinfo_endpoint".
  #
  # Defaults to "auto", which fetches the userinfo endpoint if "openid" is included
  # in `scopes`. Uncomment the following to always fetch the userinfo endpoint.
  #
  #user_profile_method: "userinfo_endpoint"

  # Uncomment to allow a user logging in via OIDC to match a pre-existing account instead
  # of failing. This could be used if switching from password logins to OIDC. Defaults to false.
  #
  #allow_existing_users: true

  # An external module can be provided here as a custom solution to mapping
  # attributes returned from a OIDC provider onto a matrix user.
  #
  user_mapping_provider:
    # The custom module's class. Uncomment to use a custom module.
    # Default is 'synapse.handlers.oidc_handler.JinjaOidcMappingProvider'.
    #
    # See https://github.com/matrix-org/synapse/blob/master/docs/sso_mapping_providers.md#openid-mapping-providers
    # for information on implementing a custom mapping provider.
    #
    # module: mapping_provider.OidcMappingProvider

    # Custom configuration values for the module. This section will be passed as
    # a Python dictionary to the user mapping provider module's `parse_config`
    # method.

    #
    # The examples below are intended for the default provider: they should be
    # changed if using a custom provider.
    #
    config:
      # name of the claim containing a unique identifier for the user.
      # Defaults to `sub`, which OpenID Connect compliant providers should provide.
      #
      #subject_claim: "sub"

      # Jinja2 template for the localpart of the MXID.
      #
      # When rendering, this template is given the following variables:
      #   * user: The claims returned by the UserInfo Endpoint and/or in the ID
      #     Token
      #
      # If this is not set, the user will be prompted to choose their
      # own username.
      #
      #localpart_template: "{{ user.preferred_username }}"

      # Jinja2 template for the display name to set on first login.
      #
      # If unset, no displayname will be set.
      #
      #display_name_template: "{{ user.given_name }} {{ user.last_name }}"

      # Jinja2 templates for extra attributes to send back to the client during
      # login.
      #
      # Note that these are non-standard and clients will ignore them without modifications.
      #
      #extra_attributes:
        #birthdate: "{{ user.birthdate }}"

Jan 23 11:09:40 vps690980 matrix-synapse[10924]: Error in configuration at 'oidc_config.user_mapping_provider.config':
Jan 23 11:09:40 vps690980 matrix-synapse[10924]:   Failed to parse config for module 'synapse.handlers.oidc_handler.JinjaOidcMappingProvider':
Jan 23 11:09:40 vps690980 matrix-synapse[10924]:     'NoneType' object has no attribute 'get'