Support importing avatars from SSO identity provider

[shaun-blake]

It would be nice to (optionally?) transfer the account picture/avatar of a user created through OpenID Connect (OIDC) to the Synapse user account. I'm using google as my provider. Their account pictures is in the picture attribute and is a url to the image.

[richvdh]

Indeed it would. I thought we had an issue open to track this, but I can't find it :)

[azmeuk]

It looks like this would only be about calling set_avatar_url from complete_sso_login_request, and map the picture claim in JinjaOidcMappingProvider. Have I missed something?

[clokep]

It looks like this would only be about calling set_avatar_url from complete_sso_login_request, and map the picture claim in JinjaOidcMappingProvider. Have I missed something?

I think that's most of it, I believe avatar URLs need to be mxc URLs though so you might need to store the image first.

[ashfame]

@squahtx We should probably re-open this issue until we cover all server configurations where media repository is outside of the main process.

I understand when media repository is outside such as matrix-media-repo, this would happen using client server API (unsure whose credentials get used for those requests) and for cases when its in worker mode, I know nothing about that at all, so can use some guidance there.

[squahtx]

Thanks for pointing that out.

We still need

• support for worker mode, when the media repository is running on another worker
• support for out-of-Synapse media repositories, such as matrix-media-repo

As per Rich's comment here:

• If the media repo is a separate synapse worker, use an internal HTTP replication API (like we have with event persisters)
• If the media repo is a separate matrix-media-repo, use its configured api with a configured shared secret

We'll need to carefully consider what the configuration settings look like to make sure it is consistent with the other settings, and isn't limited to the SSO usecase.

For examples of worker mode internal HTTP APIs, you can look for classes derived from ReplicationEndpoint. It may be necessary to define a new endpoint.