This also alphabetizes the documentation for the various OpenID providers.

Fixes https://github.com/matrix-org/synapse/issues/14147

If configured an OIDC IdP can log a user's session out of
Synapse when they log out of the identity provider.

The IdP sends a request directly to Synapse (and must be
configured with an endpoint) when a user logs out.

Linking the help article may prevent confusion regarding the creation of the necessary rule using auth0.

docbook doesn't auto-linkify links

* Update openid.md

Newer versions of keycloak returning a 404 when using the `/auth` prefix.

Related: https://github.com/matrix-org/synapse/issues/12714

... and a minor thinko fix in the sample config.

This reverts commit 158d73eb.

Revert "Sort internal changes in changelog"
Revert "Update CHANGES.md"
Revert "1.49.0rc1"
Revert "Revert "Move `glob_to_regex` and `re_word_boundary` to `matrix-python-common` (#11505) (#11527)"
Revert "Refactors in `_generate_sync_entry_for_rooms` (#11515)"
Revert "Correctly register shutdown handler for presence workers (#11518)"
Revert "Fix `ModuleApi.looping_background_call` for non-async functions (#11524)"
Revert "Fix 'delete room' admin api to work on incomplete rooms (#11523)"
Revert "Correctly ignore invites from ignored users (#11511)"
Revert "Fix the test breakage introduced by #11435 as a result of concurrent PRs (#11522)"
Revert "Stabilise support for MSC2918 refresh tokens as they have now been merged into the Matrix specification. (#11435)"
Revert "Save the OIDC session ID (sid) with the device on login (#11482)"
Revert "Add admin API to get some information about federation status (#11407)"
Revert "Include bundled aggregations in /sync and related fixes (#11478)"
Revert "Move `glob_to_regex` and `re_word_boundary` to `matrix-python-common` (#11505)"
Revert "Update backward extremity docs to make it clear that it does not indicate whether we have fetched an events' `prev_events` (#11469)"
Revert "Support configuring the lifetime of non-refreshable access tokens separately to refreshable access tokens. (#11445)"
Revert "Add type hints to `synapse/tests/rest/admin` (#11501)"
Revert "Revert accidental commits to develop."
Revert "Newsfile"
Revert "Give `tests.server.setup_test_homeserver` (nominally!) the same behaviour"
Revert "Move `tests.utils.setup_test_homeserver` to `tests.server`"
Revert "Convert one of the `setup_test_homeserver`s to `make_test_homeserver_synchronous`"
Revert "Disambiguate queries on `state_key` (#11497)"
Revert "Comments on the /sync tentacles (#11494)"
Revert "Clean up tests.storage.test_appservice (#11492)"
Revert "Clean up `tests.storage.test_main` to remove use of legacy code. (#11493)"
Revert "Clean up `tests.test_visibility` to remove legacy code. (#11495)"
Revert "Minor cleanup on recently ported doc pages  (#11466)"
Revert "Add most of the missing type hints to `synapse.federation`. (#11483)"
Revert "Avoid waiting for zombie processes in `synctl stop` (#11490)"
Revert "Fix media repository failing when media store path contains symlinks (#11446)"
Revert "Add type annotations to `tests.storage.test_appservice`. (#11488)"
Revert "`scripts-dev/sign_json`: support for signing events (#11486)"
Revert "Add MSC3030 experimental client and federation API endpoints to get the closest event to a given timestamp (#9445)"
Revert "Port wiki pages to documentation website (#11402)"
Revert "Add a license header and comment. (#11479)"
Revert "Clean-up get_version_string (#11468)"
Revert "Link background update controller docs to summary (#11475)"
Revert "Additional type hints for config module. (#11465)"
Revert "Register the login redirect endpoint for v3. (#11451)"
Revert "Update openid.md"
Revert "Remove mention of OIDC certification from Dex (#11470)"
Revert "Add a note about huge pages to our Postgres doc (#11467)"
Revert "Don't start Synapse master process if `worker_app` is set (#11416)"
Revert "Expose worker & homeserver as entrypoints in `setup.py` (#11449)"
Revert "Bundle relations of relations into the `/relations` result. (#11284)"
Revert "Fix `LruCache` corruption bug with a `size_callback` that can return 0 (#11454)"
Revert "Eliminate a few `Any`s in `LruCache` type hints (#11453)"
Revert "Remove unnecessary `json.dumps` from `tests.rest.admin` (#11461)"
Revert "Merge branch 'master' into develop"

This reverts commit 26b5d232.
This reverts commit bce4220f.
This reverts commit 966b5d0f.
This reverts commit 088d748f.
This reverts commit 14d593f7.
This reverts commit 2a3ec6fa.
This reverts commit eccc49d7.
This reverts commit b1ecd19c.
This reverts commit 9c55dedc.
This reverts commit 2d42e586.
This reverts commit 2f053f3f.
This reverts commit a15a893d.
This reverts commit 8b4b153c.
This reverts commit 494ebd73.
This reverts commit a77c3698.
This reverts commit 4eb77965.
This reverts commit 637df95d.
This reverts commit e5f426cd.
This reverts commit 8cd68b81.
This reverts commit 6cae125e.
This reverts commit 7be88fbf.
This reverts commit b3fd99b7.
This reverts commit f7ec6e7d.
This reverts commit 5640992d.
This reverts commit d26808dd.
This reverts commit f91624a5.
This reverts commit 16d39a54.
This reverts commit 8a4c2969.
This reverts commit 49e1356e.
This reverts commit d2279f47.
This reverts commit b50e39df.
This reverts commit 858d80bf.
This reverts commit 435f0448.
This reverts commit f61462e1.
This reverts commit a6f1a3ab.
This reverts commit 84dc50e1.
This reverts commit ed635d32.
This reverts commit 7b62791e.
This reverts commit 153194c7.
This reverts commit f44d729d.
This reverts commit a265fbd3.
This reverts commit b9fef1a7.
This reverts commit b0eb64ff.
This reverts commit f1795463.
This reverts commit 70cbb1a5.
This reverts commit 42bf0204.
This reverts commit 379f2650.
This reverts commit 7ff22d6d.
This reverts commit 5a0b652d.
This reverts commit 432a174b.
This reverts commit b14f8a1b, reversing
changes made to e713855d.

fix header level

Dex isn't yet [1,2] a certified OpenID Provider implementation. As of today, it's not on the list maintained by the OpenID Foundation. [3]

[1] https://github.com/dexidp/dex/issues/42
[2] https://github.com/dexidp/dex/issues/262
[3] https://openid.net/certification/

Co-authored-by: David Robertson <david.m.robertson1@gmail.com>
Co-authored-by: Julian Vanden Broeck <julian.vandenbroeck@dalibo.com>

Signed-off-by: Hugo Delval <hugo.delval@gmail.com>

* Fix the titles in the OIDC documentation

Having them as links broke the table-of-contents rendering in mdbook.
Plus there's no reason for only some of the provider titles to be links.

* Changelog

* Add link to google idp docs

The stable format uses different brand identifiers, so we need to support two
identifiers for each IdP.

Apple had to be special. They want a client secret which is generated from an EC key.

Fixes #9220. Also fixes #9212 while I'm here.

Fixes a "conflict" from 846b9d3d
and d1f13c74.

We've decided to add a 'brand' field to help clients decide how to style the
buttons.

Also, fix up the allowed characters for idp_id, while I'm in the area.

This is the final step for supporting multiple OIDC providers concurrently.

First of all, we reorganise the config so that you can specify a list of OIDC providers, instead of a single one. Before:

    oidc_config:
       enabled: true
       issuer: "https://oidc_provider"
       # etc

After:

    oidc_providers:
     - idp_id: prov1
       issuer: "https://oidc_provider"

     - idp_id: prov2
       issuer: "https://another_oidc_provider"

The old format is still grandfathered in.

With that done, it's then simply a matter of having OidcHandler instantiate a new OidcProvider for each configured provider.

This PR adds the missing user_mapping_provider section in oidc.md

Signed-off-by: Christopher Rücker <chris-ruecker@protonmail.com>

Signed-off-by: Peter Krantz <peter.krantz@gmail.com>

This allows for connecting to certain IdPs, e.g. GitLab.

docs, default configs, comments. Nothing very significant.