Test FedCM for BYOIDP

[erlend-sh]

For advocates of digital identity ownership, right now there’s a unique opportunity to tip the scales in favor of the independent web:

https://wrily.foad.me.uk/sign-in-with-big-tech-only-or-sign-in-with-whom-i-prefer

The FedCM drafters have been open to reference implementations for a month: fedidcg/FedCM#240 (comment)

Apparently there’s not even a need to use Chrome Canary for testing any longer, as an experimental option for FedCM has been added to main Chrome:

So far there’s one nearly working example in Rauthy.

With a few more proofs-of-concept, we can ensure that this emerging browser standard will benefit the entirety of the open web. Your assistance would be hugely appreciated by your fellow indies! 🙏

[stephank]

This must've slipped my attention, sorry. I hadn't heard of FedCM before, which looks really interesting, but I'm not sure Portier aligns with the goals. Portier doesn't have any login session, and doesn't really have a landing page where it could call IdentityProvider.register(). We could add such a page, though I feel it'd be difficult to communicate to users what Portier is and is trying to do. Portier is intended to be inconspicuous, in general.

In some ways, Portier competes. We have an experimental discovery mechanism that allows the email domain administrator to configure which IdP to use. Though FedCM is far more ambitious in that regard, and it'll probably do a better job if it succeeds. 🙂

[erlend-sh]

Very fair. I came to understand Portier a bit better after writing that post, so I agree with the differing goals.

That said, I think what Portier is doing could be very complementary to FedCM. Both projects are solving for a lot of the same problems, but with different solutions, catering to different types of internet users.

For my app I’d much rather support both the FedCM method as well as the Portier method of sign-in. I expect to have users who would strongly prefer one over the other, and may not even bother signing up if their preference (which can also mean accessibility requirements) isn’t available.