v132 · miscellaneous

FedCM authorization features (fka bundle 6: Continuation API, Parameters API, Fields API, Multiple configURLs, Custom account labels)

This bundles a few features that we would like to launch at the same time. We are bundling them together because they can be used by IdPs to implement authorization flows such as letting a user grant access to a user’s calendar to an RP. See also https://github.com/w3c-fedid/FedCM/issues/477.

concepts

  1. Auth Bundle

    FedCM authorization bundle 6 — Continuation API, Parameters API, Fields API, multiple configURLs, custom account labels. Enough surface for full OIDC-style auth flows over FedCM.

  2. continuation popup

    The four-step Continuation API flow: continue_on response, browser-managed popup, IdentityProvider.resolve(), settling promise.

  3. multiple configURLs

    Register several config files for one IDP. Resolution trace shows which one wins for a logged-in user, a new user, and a tenant-specific call.

  4. scope & fields builder

    Pick fields and scopes the RP needs, set custom parameters. See the generated navigator.credentials.get() and the FedCM consent dialog the browser would render.

  5. custom account labels

    IDP returns labelled accounts (personal, work, admin, student). RP passes accountHints and the browser filters — neither side sees the other's identifiers.

why it shipped

This feature provides primitives that make FedCM very extensible for IDPs. With the ability to pass additional data through the fields API and continuing the sign-in flow in a popup window, FedCM becomes a lot more customizable for IDPs.

references