hm, i wrote an answer on this but it seems to have vanished. ESS uses Matrix Authentication Service (https://github.com/element-hq/matrix-authentication-servic

hm, i wrote an answer on this but it seems to have vanished. ESS uses Matrix Authentication Service (https://github.com/element-hq/matrix-authentication-service/ https://github.com/element-hq/matrix-authentication-service/) which is a very lightweight Matrix-aware rust OIDC IdP intended for embedding into Matrix homeservers to make them OIDC-capable. It provides the same featureset as pre-OIDC Matrix auth, and then lets you delegate to an upstream IdP (keycloak, authentik, forgerock etc) for a full featureset (2FA, MFA, etc).