951306 - Implement "sign in via web" bug-out option in Android native Firefox Account UI

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: Android Sync, defect, P3)

Description

[Nick Alexander :nalexander [he/him]]

We're planning a native UI for Firefox Account sign up/sign in, but in a range of situations, we're going to want to drive users to sign in via a web interface:

* future security issues/protocol changes;
* obsolete client versions;
* future 2 factor auth;
* possibly COPPA failure messaging?
* general messaging to users;

This will require:

* an auth server response (possibly with a URL to direct the user to);
* some client code to start a browser, GeckoView, or WebView in a reasonable state;
* some client code to interpret a sign up/sign in response.

Comment 1

[Nick Alexander :nalexander [he/him]]

> * an auth server response (possibly with a URL to direct the user to);

ckarlof, rfkelly: can you file a bug or link to a github issue tracking this work?

Comment 2

[Nick Alexander :nalexander [he/him]]

> * some client code to interpret a sign up/sign in response.

nchapman, stomlinson, zaach: can you file a bug or link to a github issue tracking the "FxA for the web" work that this will consume?

Comment 3

[Chris Karlof [:ckarlof]]

I think a Web based "bug out" flow is too much for this effort. I love the idea, but let's do it later. For now, let's just make sure we can signal and handle the error.

Future key management support (pairing/2nd password): https://github.com/mozilla/fxa-auth-server/issues/451
API version obsolescence: https://github.com/mozilla/fxa-auth-server/issues/449

Are there any cases these don't cover?

Comment 4

[Ryan Kelly [:rfkelly]]

> * an auth server response (possibly with a URL to direct the user to);

Will a generic "400 Bad Request; client incompatibility detected" response suffice for the initial push, or do you require a little more nuance?

Comment 5

[Chris Karlof [:ckarlof]]

Unsupported login method: https://github.com/mozilla/fxa-auth-server/issues/452

Comment 6

[Nick Alexander :nalexander [he/him]]

Part of these unsupported login methods will be displaying server-delivered messages for clients to display.  We need to ensure we're setting l10n headers appropriately so we get appropriately translated messages.  See also Bug 957381.

Comment 7

[Richard Newman [:rnewman]]

(In reply to Ryan Kelly [:rfkelly] from comment #4)
> > * an auth server response (possibly with a URL to direct the user to);
> 
> Will a generic "400 Bad Request; client incompatibility detected" response
> suffice for the initial push, or do you require a little more nuance?

If you can follow the same pattern that we just established for Sync, then we might be able to tie something in, even if the strings suck.

Comment 8

[Zachary Carter [:zaach]]

I've filed a content-server issue here: https://github.com/mozilla/fxa-content-server/issues/569

Comment 9

[Nick Alexander :nalexander [he/him]]

We no longer support native UI for sign in.