Repository navigation
Replies: 1 comment 1 reply
|
Hi @tbroyer, we are also leaning towards FedCM and we are interested in possibly implementing this as an experimental feature (see #16834). With Keycloak JS aging and all of the recent changes to 3rd party cookies we're looking for a standardized way to replace it, and FedCM looks like a step forward. |
1 reply
|
Ha, didn't find that issue! Maybe I only searched for Great news! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
The phase-out of third-party cookies will break OIDC Front-channel logout and OIDC Session management, as well as the silent
check-ssoand Session Status iframe of the Keycloak JavaScript adapter.Proposed replacements are First-Party Sets (FPS) and FedCM. While Keycloak could probably help with FPS by supporting a
/.well-known/first-party-set.json, I'm more interested in FedCM support here (if anyone's interested in FPS, please open a separate feature request).To support FedCM, AFAICT (see also Google's Developer Guide), Keycloak would have to:
/.well-known/web-identity(if not deployed at an eTLD+1, this could at least help admins configure the eTLD+1 to return the same content, possibly just using a a reverse proxy for that file); the file would list all realms (possibly filtered if that could be enabled/disabled per-realm)branding.iconscould possibly come from the "Logo URL" in the Advanced tab, otherbrandingoptions would have to be configurable (those are optional, so the first implementation might not need to support that, and just omit those fields)All reactions