FedCM support

[elf-pavlik]

Search terms you've used

FedCM

Impacted environment

In which environment would the proposed feature apply ?

• The browser
• Node.js
• Other (please specify): ...
• I'm not sure.

Feature suggestion

Add support for FedCM (FPWD), which is on the REC track in FedID WG

Expected functionality/enhancement

The best example of how it could work with Solid-OIDC might be how it was implemented for IndieAuth.
https://indieweb.org/FedCM_for_IndieAuth

It can already be tested in Chrome behind flags.

There is also Lightweight FedCM proposal which works in Firefox nightly.
IndieAuth should also have it figured out soon.

Actual functionality/enhancement

The user will not have to enter the URL of their OP/IDP, not even their WebID. They will select their registered IDP from a small widget displayed by the browser.

Use Cases

Improved UX in the web browser.

Additional information

@thhck have done a prototype for CSS w3c-fedid/idp-registration#2 (comment)
I will coordinate with him to land everything that's needed in CSS.

@acoburn is also familiar with FedCM progress.

This feature is now tracked as IdP Registration API and needs implementation feedback and interest signals.

[NSeydoux]

Hi @elf-pavlik , thanks for opening this. Support for FedCM would be an interesting addition to this library indeed.

[michielbdejong]

We're working on this in https://github.com/Liquid-Surf/fedcm-demo and solid-contrib/pivot#34
Not much needed from the solid-client-authn-js side, as you can see from https://github.com/Liquid-Surf/fedcm-demo/blob/main/packages/client/src/solid.js which is just 66 lines of code.

[elf-pavlik]

Liquid-Surf demo seems to pass the access token through the FedCM API. Instead, it probably should pass the authorization code, similar to https://indieweb.org/FedCM_for_IndieAuth#navigator.credentials.get

This way, frontends can also work with backend clients, like the node package in this repo, and get the authorization code from the front end.

@NSeydoux can you think of the simplest way to accomplish a similar flow to the one in IndieAuth+FedCM?

• frontend request from the node backend PKCE code_challenge
• frontend passes to the backend the authorization code
• node auth module from this repo continues the flow using that authorization code, ensuring that it's used with the initial code_challenge