1803629 - [meta] FedCM Initial Release

Status: REOPENED

(Core :: DOM: Credential Management, task)

Comment 1

[Benjamin VanderSloot [:bvandersloot]]

Nightly Release Note Request
[Why is this notable]: Adding a new Web API in Nightly
[Affects Firefox for Android]: No
[Suggested wording]: Enabling a prototype Federated Credential Management implementation.
[Links (documentation, blog post, etc)]: https://fedidcg.github.io/FedCM/

Comment 2

[Dianna Smith [:diannaS]]

Added to nightly notes for 116/117
https://www.mozilla.org/en-US/firefox/116.0a1/releasenotes/

Comment 3

[Ryan VanderMeulen [:RyanVM]]

This has been dropped from the Nightly release notes now that we're more than 3 cycles out since it was added. Feel free to re-nominate once this is ready to ride the trains to release.

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

I'm curious why this was closed? I don't think Firefox has released FedCM yet?

Comment 5

[Dan Mehic]

I assumed this targeted the prototype based on Nightly release notes. I'm reverting this and adding more linked bugs for clarity.

Comment 6

[Maximilian Haupt]

Hey Benjamin. What's the state of the FedCM integration in Firefox? I see there seems to be some work in context of lightweight-fedcm. Is there a roadmap for the feature?

We are running Contentpass, a subscription service offering ad- and tracking free access to >500 websites as of today. I'm looking into FedCM to improve the UX for our users when logging in on our partner sites. Having support in brothers other than Chrome would boost the trust in the technology itself and I would be more confident enabling it for our users. I guess this is a chicken & egg situation. Mozilla not willing to spend time on implementing this if no users are asking for it, and users hesitant to implement it when there is no widespread support. If that's the case, here is my vote to have it implemented in Firefox and my plans to roll it out to our users :)

Comment 7

[Benjamin VanderSloot [:bvandersloot]]

Thanks for the interest! Use cases like yours are actually a great help to figuring out whether to put effort into this.

We are actually allocating some time to this space soon, although exactly what we end up implementing is still a little up in the air. Lightweight FedCM was initially a parallel construction of a lot of these capabilities, but has since turned into almost a subset of FedCM.

The spec has changed a lot since we last touched the relevant code, but we are sorting out the work involved to getting this into Firefox. Expect to see a lot of bugs blocking this shortly :)

Comment 8

[Cal Heldenbrand]

If you're looking for use cases and feedback, I have an industry which could really use a system for federated identities and session discovery.

I write software for the real estate industry in the US, and this market has many different companies that operate in various identity roles. Those roles can be dependent on the integration performed between the specific parties. So, depending on the product and contract signed, a domain name might be an RP to another OP, or a company that typically performs an OP role might need to flip that and behave as an RP to someone completely different.

We're effectively dealing with identity chaos, all led by both competition and cooperation.

We really need something that allows an RP to receive an unknown browser with no session, then ping other known OPs to detect an existing identity session and offer a login flow for that individual member. The entrypoints into these systems are typically global and without tenancy, yet we need custom SSO initiator paths depending on who enters the domain name.

I've only recently been reading through the FedCM stuff and I think this is what I've been looking for. I also realize this is kind of an all-or-nothing scenario when it comes to browser support. We support all browsers and I can't ship something that doesn't work with Safari too. If you can roll out something that aligns with Google, maybe it's the next step towards a critical mass adoption.

Thank you!

Comment 9

[Daniel.dagehus]

Hi Benjamin,
just checking back in on this thread as the last activity here is some time ago
I’m commenting from the netID side (federated IdP / SSO ecosystem with WEB.DE, GMX, 7Pass as Account Provider). We already support FedCM on the IdP side (including multi-IdP) and have live deployments with several large publishers acting as relying parties.
On Chromium-based browsers this is already in production, and we’re seeing strong improvements in UX for the User and login/registration performance.
Do you have any updated view on Firefox support or rough timing at this point?
From our perspective, broader cross-browser support is important for making FedCM a viable, interoperable standard across the open web.

Thanks!

Comment 10

[Manuel Bucher [:manuel] {{ FYI: OOO Jul 30 - Aug 16 }}]

Setting needinfo for comment 9.

Comment 11

[Benjamin VanderSloot [:bvandersloot]]

Hello Daniel!

At Mozilla, FedCM was invested in as a new purpose-built API for federated authentication that would allow us to remove our third-party cookie heuristics. Unfortunately, when Chrome gave up on removing third-party cookies, we no longer saw an immediate path to enough adoption to remove those heuristics. At the same time we had a renewed urgency to handle web compatibility issues; we could no longer count on a future with a unified cookie behavior to relieve that pressure. As a result, FedCM became something I couldn't justify allocating resources toward. So unfortunately, it is not on our roadmap at this time and I haven't been following the standard's development. That's not to say that federated authentication isn't still an area of interest, just that FedCM's particular tradeoffs were not aligned to what we thought would benefit Firefox users most. Interest from other identity providers is important to how we make this tradeoff as we continuously update our priorities, so thank you for reaching out!