diff --git a/README.md b/README.md index 1de0ce8..5d798fe 100644 --- a/README.md +++ b/README.md @@ -5,14 +5,14 @@ mxisd - Federated Matrix Identity Server Daemon - [Overview](#overview) - [Features](#features) - [Why use mxisd](#why-use-mxisd) -- [Quick start](#quick-start) +- [Getting Started](#getting-started) - [Support](#support) - [Contribute](#contribute) - [FAQ](#faq) - [Contact](#contact) # Overview -mxisd is a Federated Matrix Identity server for self-hosted Matrix infrastructures with enhanced features. +mxisd is a Federated Matrix Identity server for self-hosted Matrix infrastructures with [enhanced features](#features). It is specifically designed to connect to an Identity store (AD/Samba/LDAP, SQL Database, Web services/application, ...) and ease the integration of the Matrix ecosystem with an existing infrastructure, or to build a new one using lasting @@ -29,8 +29,9 @@ users. 3PIDs can be anything that identify a user, like: - Facebook ID - ... -mxisd is an enhanced Identity service, which implements the [Matrix Identity service API](https://matrix.org/docs/spec/identity_service/unstable.html) -but also several other features that greatly enhance user experience within Matrix. +mxisd is an enhanced Identity service, which implements the +[Matrix Identity service API](https://matrix.org/docs/spec/identity_service/unstable.html) but also several +[other features](#features) that greatly enhance user experience within Matrix. mxisd is the one stop shop for anything regarding Authentication, Directory and Identity management in Matrix built as a single coherent product. @@ -64,115 +65,20 @@ currently **cannot be removed** - Users can directly find each other using whatever attribute is relevant within your Identity store - Federate your Identity lookups so you can discover others and/or others can discover you, all with extensive ACLs -# Quick Start -1. [Preparation](#preparation) -2. [Install](#install) -3. [Configure](#configure) -4. [Integrate](#integrate) -5. [Validate](#validate) - -Following these quick start instructions, you will have a basic setup that can perform recursive/federated lookups and -talk to the central Matrix.org Identity service. -This will be a good ground work for further integration with your existing Identity stores. - -## Preparation -You will need: -- Homeserver -- Reverse proxy with regular TLS/SSL certificate (Let's encrypt) for your mxisd domain - -As synapse requires an HTTPS connection when talking to an Identity service, a reverse proxy is required as mxisd does -not support HTTPS listener at this time. - -For maximum integration, it is best to have your Homeserver and mxisd reachable via the same hostname. -You can also use a dedicated domain for mxisd, but will not have access to some features. - -Be aware of a [NAT/Reverse proxy gotcha](https://github.com/kamax-io/mxisd/wiki/Gotchas#nating) if you use the same -hostname. - -The following Quick Start guide assumes you will host the Homeserver and mxisd under the same hostname. -If you would like a high-level view of the infrastructure and how each feature is integrated, see the -[dedicated document](docs/architecture.md) - -## Install -Install via: -- [Debian package](docs/install/debian.md) -- [Docker image](docs/install/docker.md) -- [Sources](docs/build.md) - -See the [Latest release](https://github.com/kamax-io/mxisd/releases/latest) for links to each. - -## Configure -Create/edit a minimal configuration (see installer doc for the location): -``` -matrix.domain: 'MyMatrixDomain.org' -key.path: '/path/to/signing.key.file' -storage.provider.sqlite.database: '/path/to/mxisd.db' -``` -- `matrix.domain` should be set to your Homeserver domain -- `key.path` will store the signing keys, which must be kept safe! -- `storage.provider.sqlite.database` is the location of the SQLite Database file which will hold state (invites, etc.) - -If your HS/mxisd hostname is not the same as your Matrix domain, configure `server.name`. -Complete configuration guide is available [here](docs/configure.md). - -## Integrate -For an overview of a typical mxisd infrastructure, see the [dedicated document](docs/architecture.md) -### Reverse proxy -#### Apache2 -In the VirtualHost handling the domain with SSL, add the following line and replace `0.0.0.0` by the right address/host. -**This line MUST be present before the one for the homeserver!** -``` -ProxyPass /_matrix/identity/ http://0.0.0.0:8090/_matrix/identity/ -``` - -Typical VirtualHost configuration would be: -``` - - ServerName example.org - - ... - - ProxyPreserveHost on - ProxyPass /_matrix/identity/ http://10.1.2.3:8090/_matrix/identity/ - ProxyPass /_matrix/ http://10.1.2.3:8008/_matrix/ - -``` - -### Synapse -Add your mxisd domain into the `homeserver.yaml` at `trusted_third_party_id_servers` and restart synapse. -In a typical configuration, you would end up with something similair to: -``` -trusted_third_party_id_servers: - - matrix.org - - vector.im - - example.org -``` -It is recommended to remove `matrix.org` and `vector.im` so only your own Identity server is allowed by synapse. - -### Federation and network discovery -See the [dedicated document](docs/features/federation.md). - -## Validate -Log in using your Matrix client and set `https://example.org` as your Identity server URL, replacing `example.org` by -the relevant hostname which you configured in your reverse proxy. -Invite `mxisd-lookup-test@kamax.io` to a room, which should be turned into a Matrix invite to `@mxisd-lookup-test:kamax.io`. -**NOTE:** you might not see a Matrix suggestion for the e-mail address, which is normal. Still proceed with the invite. - -If it worked, it means you are up and running and can enjoy mxisd in its basic mode! Congratulations! -If it did not work, [get in touch](#support) and we'll do our best to get you started. - -You can now integrate mxisd further with your infrastructure using the various [features](docs/README.md) guides. +# Getting started +See the [dedicated document](docs/getting-started.md) # Support ## Community If you need help, want to report a bug or just say hi, you can reach us on Matrix at -[#mxisd:kamax.io](https://matrix.to/#/#mxisd:kamax.io) or [directly peek anonymously](https://view.matrix.org/room/!NPRUEisLjcaMtHIzDr:kamax.io/). +[#mxisd:kamax.io](https://matrix.to/#/#mxisd:kamax.io) or +[directly peek anonymously](https://view.matrix.org/room/!NPRUEisLjcaMtHIzDr:kamax.io/). For more high-level discussion about the Identity Server architecture/API, go to [#matrix-identity:matrix.org](https://matrix.to/#/#matrix-identity:matrix.org) ## Professional -If you would prefer professional support/custom development for mxisd and/or for Matrix in general, including other open source technologies/products, -please visit [our website](https://www.kamax.io/) to get in touch with us and get a quote. +If you would prefer professional support/custom development for mxisd and/or for Matrix in general, including other open +source technologies/products, please visit [our website](https://www.kamax.io/) to get in touch with us and get a quote. We offer affordable monthly/yearly support plans for mxisd, synapse or your full Matrix infrastructure. @@ -194,64 +100,7 @@ maintained regularly and you get direct access to the support team. - Sponsoring new features or bug fixes. [Get in touch](#contact) so we can discuss it further. # FAQ -### Do I need to use mxisd if I run a Homeserver? -No, but it is recommended, even if you don't use any backends or integration. - -mxisd in its default configuration will use federation and involve the central Matrix.org Identity servers when -performing queries, giving you access to at least the same information as if you were not running it. - -It will also give your users a choice to make their 3PIDs available publicly, ensuring they are made aware of the -privacy consequences, which is not the case with the central Matrix.org servers. - -So mxisd is like your gatekeeper and guardian angel. It does not change what you already know, just adds some nice -simple features on top of it. - -### I already use the synapse LDAP3 auth provider, why should I care about mxisd? -The [synapse LDAP3 auth provider](https://github.com/matrix-org/matrix-synapse-ldap3) only handles on specific flow: -validate credentials at login. - -It does not: -- Auto-provision user profiles -- Integrate with Identity management -- Integrate with Directory searches -- Protect you against the username case sensitivites issues in synapse - -mxisd is a replacement and enhancement of it, and also offers coherent results in all areas, which LDAP3 auth provider -does not. - -### I saw that sydent is the official Identity server implemenation of the Matrix team, I should use that! -You can, but [sydent](https://github.com/matrix-org/sydent): -- [should not be used and/or self-hosted](https://github.com/matrix-org/sydent/issues/22) -- is not meant to be linked to a specific Homeserver / domain -- cannot handle federation or proxy lookups, effectively isolating your users from the rest of the network -- forces you to duplicate all your identity data, so people can be found by 3PIDs -- forces users to enter all their emails and phone numbers manually in their profile - -So really, you should go with mxisd. - -### I'm not sure I understand what an "Identity server" is supposed to be or do -The current Identity service API is more a placeholder, as the Matrix devs did not have time so far to really work on -what they want to do with that part of the ecosystem. Therefore, "Identity" is a misleading word currently. -Given the scope of the current Identity Service API, it would be best called "Invitation service". - -Because the current scope is so limited and no integration is done with the Homeserver, there was a big lack of features -for groups/corporations/organisation. This is where mxisd comes in. - -mxisd implements the Identity Service API and also a set of features which are expected by regular users, truly living -up to its "Identity server" name. - -### So mxisd is just a big hack! I don't want to use non-official features! -mxisd primary concern is to always be compatible with the Matrix ecosystem and the Identity service API. -Whenever the API will be updated and/or enhanced, mxisd will follow, remaining 100% compatible with the ecosystem. - -We also directly talk with the Matrix developers to ensure all features we implement have their approval, and that we -are in line with their vision of Identity management within the Matrix ecosystem. - -Therefore, using mxisd is a safe choice. It will be like using the central Matrix.org Identity servers, yet not closing -the door to very nice enhancements and integrations. - -### Should I use mxisd if I don't host my own Homeserver? -No +See the [dedicated document](docs/faq.md) # Contact Get in touch via: diff --git a/docs/backends/README.md b/docs/backends/README.md new file mode 100644 index 0000000..0dbc07b --- /dev/null +++ b/docs/backends/README.md @@ -0,0 +1,5 @@ +# Identity Stores (Backends) +- [Samba / Active Directory / LDAP](ldap.md) +- [SQL Databases](sql.md) +- [Website / Web service / Web app](rest.md) +- [Google Firebase](firebase.md) \ No newline at end of file diff --git a/docs/backends/firebase.md b/docs/backends/firebase.md index a9e00d7..0ec19ec 100644 --- a/docs/backends/firebase.md +++ b/docs/backends/firebase.md @@ -1,4 +1,14 @@ # Google Firebase +https://firebase.google.com/ + +## Requirements +This backend requires a suitable Matrix client capable of performing Firebase authentication and passing the following +information: +- Firebase User ID as Matrix username +- Firebase token as Matrix password + +If your client is Riot, you will need a custom version. + ## Configuration To be completed. For now, see default structure and values: ``` @@ -6,4 +16,4 @@ firebase: enabled: false credentials: '/path/to/firebase/credentials.json' database: 'https://my-project.firebaseio.com/' -``` \ No newline at end of file +``` diff --git a/docs/backends/ldap.md b/docs/backends/ldap.md index 6f45f55..f3dfa40 100644 --- a/docs/backends/ldap.md +++ b/docs/backends/ldap.md @@ -1,53 +1,95 @@ -# AD/Samba/LDAP backend +# LAP (Samba / Active Directory / OpenLDAP) +## Getting started +To use your LDAP backend, add the bare minimum configuration in mxisd config file: +``` +ldap.enabled: true +ldap.connection.host: 'ldapHostnameOrIp' +ldap.connection.bindDn: 'CN=My Mxisd User,OU=Users,DC=example,DC=org' +ldap.connection.bindPassword: 'TheUserPassword' +ldap.connection.baseDn: 'OU=Users,DC=example,DC=org' +``` +These are standard LDAP connection configuration. mxisd will try to connect on port default port 389 without encryption. + +--- + +If you would like to use a TLS/SSL connection, use the following configuration options (STARTLS not supported): +``` +ldap.connection.tls: true +ldap.connection.port: 12345 +``` + +--- + +You can also set a default global filter on any LDAP queries: +``` +ldap.filter: '(memberOf=CN=My Matrix Users,OU=Groups,DC=example,DC=org)' +``` +This example would only return users part of the group called `My Matrux Users`. +This can be overwritten or append in each specific flow describe below. + +--- + +LDAP features are based on mapping LDAP attributes to Matrix concepts, like a Matrix ID, its localpart, the user display +name, their email(s) and/or phone number(s). + +Default attributes are well suited for Active Directory/Samba. In case you are using a native LDAP backend, you will +most certainly configure those mappings. + +The following example would set the `uid` attribute as localpart and the Matrix display name to `cn` +``` +ldap.attribute.uid.type: 'uid' +ldap.attribute.uid.value: 'uid' +ldap.attribute.name: 'cn' +``` + +You can also change the attribute lists for 3PID, like email or phone numbers. +The following example would overwrite the [default list of attributes](../../src/main/resources/application.yaml#L67) for emails and phone number: +``` +ldap.attribute.threepid.email: + - 'mail' + - 'otherMailAttribute' + +ldap.attribute.threepid.msisdn: + - 'phone' + - 'otherPhoneAttribute' +``` + +## Identity +Identity features (related to 3PID invites or searches) are enabled and configured using default values and no specific +configuration item is needed to get started. + +If you would like to overwrite some global configuration relative to filter and/or attributes, see the Identity section +of the Configuration below. + +## Authentication +No further configuration is needed to enable authentication with LDAP once globally enabled and configured. +You have the possiblity to use a different query filter if you wish, see Configuration below. + +## Directory +No further configuration is needed to enable directory with LDAP once globally enabled and configured. + +If you would like to use extra attributes in search that are not 3PIDs, like nicknames, group names, employee number: +``` +ldap.directory.attribute.other: + - 'myNicknameAttribute' + - 'memberOf' + - 'employeeNumberAttribute' +``` + ## Configuration -### Structure and default values -``` -ldap: - enabled: false - filter: '' - connection: - host: '' - tls: false - port: 389 - bindDn: '' - bindPassword: '' - baseDn: '' - attribute: - uid: - type: 'uid' - value: 'userPrincipalName' - name: 'displayName' - threepid: - email: - - 'mailPrimaryAddress' - - 'mail' - - 'otherMailbox' - msisdn: - - 'telephoneNumber' - - 'mobile' - - 'homePhone' - - 'otherTelephone' - - 'otherMobile' - - 'otherHomePhone' - auth: - filter: '' - directory: - attribute: - other: [] - filter: '' - identity: - filter: '' - medium: - email: '' - msisdn: '' -``` +Please read the [Configuration](../configure.md) explanatory note if you are not familiar with the terms used below. + ### General +Base path: `ldap` + | Item | Description | |-----------|-------------------------------------------------------------------------------------------| | `enabled` | Globaly enable/disable the LDAP backend | | `filter` | Global filter to apply on all LDAP queries. Can be overwritten in each applicable section | ### Connection +Base path: `ldap.connection` + | Item | Description | |----------------|------------------------------------------------------| | `host` | Host to connect to | @@ -58,6 +100,8 @@ ldap: | `baseDn` | Base DN for queries | ### Attributes +Base path: `ldap.attribute` + | Item | Description | |-------------|------------------------------------------------------------------------------------------------------------------------| | `uid.type` | Indicate how to process the User ID (UID) attribute: | @@ -68,11 +112,15 @@ ldap: | `threepid` | Namespace where each key is a 3PID type and contains a list of attributes | ### Authentication +Base path: `ldap.auth` + | Item | Description | |----------|--------------------------------------------------------------------------------------------------| | `filter` | Specific user filter applied during authentication. Global filter is used if empty/blank/not set | ### Directory +Base path: `ldap.directory` + | Item | Description | |-------------------|---------------------------------------------------------------------| | `attribute.other` | Additional attributes to be used when performing directory searches | @@ -80,6 +128,8 @@ ldap: | | Global filter is used if empty/blank/not set | ### Identity +Base path: `ldap.identity` + | Item | Description | |----------|---------------------------------------------------------------------------------------------------| | `filter` | Specific user filter applied during identity search. Global filter is used if empty/blank/not set | diff --git a/docs/configure.md b/docs/configure.md index aa14991..c8712dd 100644 --- a/docs/configure.md +++ b/docs/configure.md @@ -37,7 +37,7 @@ server: **WARNING:** mxisd might overwrite/adapt some values during launch. Those changes will not be reflected into copied keys. ## Categories -For each category below, the base configuration path will be given, which needs to be appened to every configuration +For each category below, the base configuration path will be given, which needs to be appended to every configuration item described. Example: if the base path was `basePath` and the following table was given: diff --git a/docs/faq.md b/docs/faq.md new file mode 100644 index 0000000..3e84bd7 --- /dev/null +++ b/docs/faq.md @@ -0,0 +1,65 @@ +# FAQ +### Do I need to use mxisd if I run a Homeserver? +No, but it is recommended, even if you don't use any backends or integration. + +In its default configuration, mxisd will talk to the central Matrix Identity servers and use other federated public +servers when performing queries, giving you access to at least the same information as if you were not running it. + +It will also give your users a choice to make their 3PIDs available publicly, ensuring they are made aware of the +privacy consequences, which is not the case with the central Matrix.org servers. + +So mxisd is like your gatekeeper and guardian angel. It does not change what you already know, just adds some nice +simple features on top of it. + +### I already use the synapse LDAP3 auth provider, why should I care about mxisd? +The [synapse LDAP3 auth provider](https://github.com/matrix-org/matrix-synapse-ldap3) is not longer maintained and +only handles on specific flow: validate credentials at login. + +It does not: +- Auto-provision user profiles +- Integrate with Identity management +- Integrate with Directory searches +- Protect you against the username case sensitivites issues in synapse + +mxisd is a replacement and enhancement of it, offering coherent results in all areas, which LDAP3 auth provider +does not. + +### Sydent is the official Identity server implementation of the Matrix team, why not use that? +You can, but [sydent](https://github.com/matrix-org/sydent): +- [should not be used and/or self-hosted](https://github.com/matrix-org/sydent/issues/22) +- is not meant to be linked to a specific Homeserver / domain +- cannot handle federation or proxy lookups, effectively isolating your users from the rest of the network +- forces you to duplicate all your identity data, so people can be found by 3PIDs +- forces users to enter all their emails and phone numbers manually in their profile + +So really, you should go with mxisd. + +### Will I loose access to the central Matrix.org/Vector.im Identity data if I use mxisd? +In its default configuration, mxisd act as a proxy to Matrix.org/Vector.im. You will have access to the same data and +behaviour than if you were using them directly. There is no downside in using mxisd with the default configuration. + +mxisd can also be configured not to talk to the central Identity servers if you wish. + +### I'm not sure I understand what an "Identity server" is supposed to be or do +The current Identity service API is more a placeholder, as the Matrix devs did not have time so far to really work on +what they want to do with that part of the ecosystem. Therefore, "Identity" is a misleading word currently. +Given the scope of the current Identity Service API, it would be best called "Invitation service". + +Because the current scope is so limited and no integration is done with the Homeserver, there was a big lack of features +for groups/corporations/organisation. This is where mxisd comes in. + +mxisd implements the Identity Service API and also a set of features which are expected by regular users, truly living +up to its "Identity server" name. + +### So mxisd is just a big hack! I don't want to use non-official features! +mxisd primary concern is to always be compatible with the Matrix ecosystem and the Identity service API. +Whenever the API will be updated and/or enhanced, mxisd will follow, remaining 100% compatible with the ecosystem. + +We also directly talk with the Matrix developers to ensure all features we implement have their approval, and that we +are in line with their vision of Identity management within the Matrix ecosystem. + +Therefore, using mxisd is a safe choice. It will be like using the central Matrix.org Identity servers, yet not closing +the door to very nice enhancements and integrations. + +### Should I use mxisd if I don't host my own Homeserver? +No diff --git a/docs/features/authentication.md b/docs/features/authentication.md index dbe8aab..5d3d196 100644 --- a/docs/features/authentication.md +++ b/docs/features/authentication.md @@ -1,6 +1,7 @@ # Authentication -Performed via [synapse with REST auth module](https://github.com/kamax-io/matrix-synapse-rest-auth/blob/master/README.md) -Point the `endpoint` to mxisd internal IP on port 8090 +Authentication is an enchanced Identity feature of mxisd to ensure coherent and centralized identity management. + +It allows to use Identity stores configured in mxisd to authenticate users on your Homeserver. ## Overview ``` @@ -23,6 +24,26 @@ Point the `endpoint` to mxisd internal IP on port 8090 | user profiles | If valid credentials and supported by backend +--------------------------+ ``` +Performed on [synapse with REST auth module](https://github.com/kamax-io/matrix-synapse-rest-auth/blob/master/README.md) + +## Getting started +### Synapse +You will need: +- Configure and enable at least one [Identity store](../backends/) +- Install the [REST auth module](https://github.com/kamax-io/matrix-synapse-rest-auth) + +Once installed, edit your synapse configuration as described for the auth module: +- Set `endpoint` to `http://mxisdAddress:8090` - Replace `mxisdAddress` to an internal IP/Hostname. +- If you want to avoid [known issues](https://github.com/matrix-org/matrix-doc/issues/586) with lower/upper case +usernames, set `enforceLowercase` in the REST config to `true`. + +**IMPORTANT**: if this is a new installation, it is highly recommended to enforce lowercase, as it is not possible to +workaround the bug at a later date and will cause issues with invites, searches, authentication. + +Restart synapse and login on the Homeserver using credentials present in your backend. ## Profile auto-fill -To be documented \ No newline at end of file +Auto-filling user profile depends on two conditions: +- The REST auth module is configured for it, which is the case by default +- Your Identity store is configured to provide profile data. See your Identity store [documentation](../backends/) on +how to enable the feature. diff --git a/docs/getting-started.md b/docs/getting-started.md new file mode 100644 index 0000000..bb4045c --- /dev/null +++ b/docs/getting-started.md @@ -0,0 +1,111 @@ +# Getting started +1. [Preparation](#preparation) +2. [Install](#install) +3. [Configure](#configure) +4. [Integrate](#integrate) +5. [Validate](#validate) +6. [Next steps](#next-steps) + +Following these quick start instructions, you will have a basic setup that can perform recursive/federated lookups and +talk to the central Matrix.org Identity service. +This will be a good ground work for further integration with your existing Identity stores. + +## Preparation +You will need: +- Homeserver +- Reverse proxy with regular TLS/SSL certificate (Let's encrypt) for your mxisd domain + +As synapse requires an HTTPS connection when talking to an Identity service, a reverse proxy is required as mxisd does +not support HTTPS listener at this time. + +For maximum integration, it is best to have your Homeserver and mxisd reachable via the same hostname. +You can also use a dedicated domain for mxisd, but will not have access to some features. + +Be aware of a [NAT/Reverse proxy gotcha](https://github.com/kamax-io/mxisd/wiki/Gotchas#nating) if you use the same +hostname. + +The following Quick Start guide assumes you will host the Homeserver and mxisd under the same hostname. +If you would like a high-level view of the infrastructure and how each feature is integrated, see the +[dedicated document](docs/architecture.md) + +## Install +Install via: +- [Debian package](docs/install/debian.md) +- [Docker image](docs/install/docker.md) +- [Sources](docs/build.md) + +See the [Latest release](https://github.com/kamax-io/mxisd/releases/latest) for links to each. + +## Configure +Create/edit a minimal configuration (see installer doc for the location): +``` +matrix.domain: 'MyMatrixDomain.org' +key.path: '/path/to/signing.key.file' +storage.provider.sqlite.database: '/path/to/mxisd.db' +``` +- `matrix.domain` should be set to your Homeserver domain +- `key.path` will store the signing keys, which must be kept safe! +- `storage.provider.sqlite.database` is the location of the SQLite Database file which will hold state (invites, etc.) + +If your HS/mxisd hostname is not the same as your Matrix domain, configure `server.name`. +Complete configuration guide is available [here](docs/configure.md). + +## Integrate +For an overview of a typical mxisd infrastructure, see the [dedicated document](docs/architecture.md) +### Reverse proxy +#### Apache2 +In the VirtualHost handling the domain with SSL, add the following line and replace `0.0.0.0` by the right address/host. +**This line MUST be present before the one for the homeserver!** +``` +ProxyPass /_matrix/identity/ http://0.0.0.0:8090/_matrix/identity/ +``` + +Typical VirtualHost configuration would be: +``` + + ServerName example.org + + ... + + ProxyPreserveHost on + ProxyPass /_matrix/identity/ http://10.1.2.3:8090/_matrix/identity/ + ProxyPass /_matrix/ http://10.1.2.3:8008/_matrix/ + +``` + +### Synapse +Add your mxisd domain into the `homeserver.yaml` at `trusted_third_party_id_servers` and restart synapse. +In a typical configuration, you would end up with something similair to: +``` +trusted_third_party_id_servers: + - matrix.org + - vector.im + - example.org +``` +It is recommended to remove `matrix.org` and `vector.im` so only your own Identity server is allowed by synapse. + +### Federation and network discovery +See the [dedicated document](docs/features/federation.md). + +## Validate +Log in using your Matrix client and set `https://example.org` as your Identity server URL, replacing `example.org` by +the relevant hostname which you configured in your reverse proxy. +Invite `mxisd-lookup-test@kamax.io` to a room, which should be turned into a Matrix invite to `@mxisd-lookup-test:kamax.io`. +**NOTE:** you might not see a Matrix suggestion for the e-mail address, which is normal. Still proceed with the invite. + +If it worked, it means you are up and running and can enjoy mxisd in its basic mode! Congratulations! +If it did not work, [get in touch](#support) and we'll do our best to get you started. + +You can now integrate mxisd further with your infrastructure using the various [features](docs/README.md) guides. + +## Next steps +Once your mxisd server is up and running, here are the next steps to further enhance and integrate your installation: + +Enable extra features: +- Authenticate with synapse, profile auto-provisioning if you wish +- Directory search + +Use your Identity stores: +- LDAP / Samba / Active directory +- SQL Database +- Website / Web service / Web app