754926 - BigTent tracking - ProxyIdP for Persona

Status: RESOLVED FIXED

(Cloud Services :: Server: Identity, defect)

Description

[Austin King [:ozten]]

This is the tracking bug for
https://wiki.mozilla.org/Identity/BrowserID/BigTent

Comment 1

[Anant Narayanan [:anant]]

The only feature the native ID implementation will need from BigTent is to be able to query for which domains are supported by the ProxyIDP. We need this to restrict navigation to just that domain in the login window (in the secondary case, navigation is tied to browserid.org/persona.org and anything else is disallowed).

If there is some reason not to expose the domain list, we could also simply keep two hardcoded lists in the client & server, but that's a bit more ugly.

Comment 2

[Dan Callahan [:callahad]]

Hi :anant, could you clarify exactly what information you need? In particular, I'm thinking that the email domain may not match the domain that gets loaded by BigTent. (Hotmail users, for instance, auth on a subdomain of live.com, not hotmail.com).

We also can't prevent proxied IdPs from arbitrarily redirecting users, and I'm not sure we can fully enumerate valid domains beyond the first redirect. (Windows Live, at the very least, sends the user through two subdomains of live.com, and I'd expect that to change with the retirement of the Windows Live brand.)

I imagine we could either provide a list of proxied email domains, or a list of valid initial redirect domains, but I'm not sure we can put together a comprehensive whitelist.

Comment 3

[Dan Callahan [:callahad]]

Should this be closed as a dupe of Bug #757983 or vice versa? There are more bugs hanging off of 757983...

Comment 4

[Austin King [:ozten]]

Bug#757983 is for Ops.

This bug is for the overall project.

Comment 5

[Austin King [:ozten]]

Just a status update:

The scope of the first release has been narrowed to Yahoo.com only.

Based on our research, this is the smallest of the 3 providers and will allow us to gain experience with this new architecture before enabling others.