Add use case details for approved_clients field #41496
Conversation
chrisdavidmills
requested review from
wbamberg
and removed request for
a team
chrisdavidmills
changed the title
| > [!NOTE] | ||
| > The disclosure text is the information shown to the user (which can include the terms of service and privacy policy links, if provided) if they are signed in to the IdP but don't have an account specifically with the current RP. In such a case, they'd need to choose "Continue as..." to continue with their IdP identity and then create a corresponding account on the RP. |
There was a problem hiding this comment.
I'm not sure this is the best place to put the definition of disclosure. AIUI this page is really about what the IdP has to do to support FedCM. So in a sense, they don't really care about disclosure - all they need to know is what they put in known_clients. What the browser is going to do with that is really up to the browser.
It would be better IMO to talk about disclosure in https://pr41496.review.mdn.allizom.net/en-US/docs/Web/API/FedCM_API/RP_sign-in#fedcm_sign-in_flow, maybe somewhere around step 8?
Also as an IdP, I want to know: when do I add a client to known_clients. What does "registered" mean for me? Is it in https://pr41496.review.mdn.allizom.net/en-US/docs/Web/API/FedCM_API/IDP_integration#the_id_assertion_endpoint, if authentication is successful and disclosure_text_shown was true?
Conversely, when should I remove the client from known_clients?
2 participants
Description
In our Identity provider integration with FedCM page, we mention the
approved_clientsfield of the accounts list endpoint JSON, but we don't say what it does.This PR aims to add that detail.
Motivation
Additional details
Related issues and pull requests
Fixes #38259