search

w3c-fedid / idp-registration

A proposal to extend FedCM to allow RPs to accept "any" registered IdP
4 stars 0 forks source link

IdP Registration same-site v same-origin #3

Open philsmart opened 3 months ago

philsmart commented 3 months ago

IdP registration is currently same-origin, I believe. With the relaxation of the login status API to using same-site over same-origin (https://github.com/fedidcg/FedCM/pull/538), I wondered if the same relaxation would benefit IdP registration. That is, for example, a University welcome page at https://welcome.university.ac.uk (or even https://www.university.ac.uk) could include a button (or something) that could register https://idp.university.ac.uk/fedcm/config.json as an Identity Provider.

Or you already can, and I am being dumb.

cbiesinger commented 3 months ago

In Chrome's implementation it is currently same-origin. It seems fine to change it to same-site.

judielaine commented 3 months ago

So if the university had a identity proxy that redirects authentication to their IDP, the university hospital's IDP, and three different labs/foundations at https//oneuni.university.ac.uk/fedcm/config.json the registration for both the univeristy and the proxy could be done at https://welcome.university.ac.uk but if the hospital's IdP were at http:/idp.unihospital.ac.uk the registration button would be elsewhere.

I think this would be great -- supporting a same site registration capability) because if could bring many intermediary systems under one point of registry.