Open berilee opened 2 years ago
Discussed during the 3 December 2021 fedidcg call
Does anyone have examples of signed-in cross origin iframes in a learning management system? I am mostly interested in what type of task the cross-origin iframe accomplishes. Chat widget? Renders a specialized type of content? Gives access to trade publications?
The purpose of my question is to help the Chrome team have accurate examples of each use case. I went back into the learning management system for the university I attended and my quick look did not find any cross origin iframes in the alumni portal. There were links to third party apps which opened in a separate tab.
I understand and agree that Chrome should not care about who the third party widgets are.
Ping on this question
User story
As a user I want to access my RP, in this example a learning management system, and have access to the embedded resources without having to authorize each resource.![Screen Shot 2021-11-30 at 5 09 10 PM](https://user-images.githubusercontent.com/94062763/144136095-0de86f78-cc96-44fa-abd7-8c60503d6665.png)
Case 1: User signed in to IDP before signing into LMS
b. lms.contoso.com can fetch an authorization token for the user from login.microsoftonline.com c. Each of the embedded iframes can fetch a token for the user from login.microsoftonline.com i. teams.microsoft.com can fetch a token for the user from login.microsoftonline.com ii. onenote.com can fetch a token for the user from login.microsoftonline.com iii. embedded.third-party.com can fetch a token for the user from login.microsoftonline.com d. Each of the embedded RP iframes has implicit permission for front-channel logout
Case 2: User signed out of IDP before signing into LMS
Out of scope:
Q: Do the embedded iframes need access to the login.microsoftonline.com cookie outside of fetching tokens?
Q: What types of tokens do the iframes need access to? id_token, access_token, refresh_token, other?
Context of the story
Assumptions: The IDP and the LMS are not the same first-party
This specific case of a learning management system would be EDU, but a similar setup exists in consumer and enterprise contexts as well.
Q: For the consumer context, what is the behavior the consumer would expect/want here? Does the consumer expect the embedded RPs and login.microsoftonline.com to know about each other?
Should this be considered sanctioned or unsanctioned tracking?
Unknown / TBD
Explicit list of parties involved
Privacy implications
Complicating characteristics
[TBD]
Additional information
[N/A]