Login with FedCM or IndieAuth

[erlend-sh]

https://blog.erlend.sh/indie-social-sign-in-could-go-mainstream

Domain names as handles is a flagship feature of the Bluesky network. It follows rather naturally that users ought also be able to log into the network using their own domains.

https://bsky.app/profile/erlend.sh/post/3l3itw5fqil2f

[bnewbold]

This looks intriguing! In the context of atproto handles, it seems like this could work at least two ways: folks could log in to their atproto PDS using their domain using FedCM/IndieAuth (aka, atproto PDS as the Relying Party); or they could use an atproto PDS (possibly self-hosted, possibly on their own domain) to log in to other services using FedCM/IndieAuth. Does that sound right?

We have made a big push/investment in getting out the atproto profile of OAuth (based on OAuth 2.1 and client metadata), which is related. Have you checked that out?

• Draft OAuth Spec atproto-website#326
• https://docs.bsky.app/docs/advanced-guides/oauth-client

It ends up achieving some of the same goals, and allows both authz and authn use-cases, but we didn't end up with direct OIDC compatibility.

[aaronpk]

@bnewbold what we're missing as far as the FedCM spec development is concerned is demonstration of interest from relying parties for this feature, so that could absolutely be atproto apps as relying parties.

[anderspitman]

I want to make sure I'm understanding correctly. When I log in to Bluesky, I see an option to select my hosting provider (which is the PDS, right?), with Bluesky Social as the default. I'm assuming if I selected my own server, I would first be redirected in some way and have to log in to it, then be redirected back and also provide my Bluesky credentials for the app? Or would the app piggyback off my PDS session and log me in automatically? Sorry, I haven't made time to dig into the ATProto architecture enough yet.

Basically I'm wondering if identity is anchored in the PDS, maybe it makes the most sense for the PDS to be a FedCM IdP, and for ATProto apps to be FedCM RPs. This feels fairly intuitive to me, where your identity is closely tied to where your data lives.

[bnewbold]

Just want to say that while I haven't had time to follow-up on this, we are very very interested in FedCM. Please do poke again or reach out to set up a meeting if there is timeline urgency.

[samuelgoto]

I'm late to this party, but wanted to help in whichever way I can here! I'm a big blue sky fan (https://bsky.app/profile/sgo.to) and would love to find ways to help whichever way I can as a browser engineer!!!

Aside from facilitating login (which, in and on itself is a big deal, I think), here is another idea that I'm excited about for Blue Sky:

w3c-fedid/idp-registration#15

Basically I'm wondering if identity is anchored in the PDS, maybe it makes the most sense for the PDS to be a FedCM IdP, and for ATProto apps to be FedCM RPs. This feels fairly intuitive to me, where your identity is closely tied to where your data lives.

This makes sense to me! Does anyone know what would be missing here to accomplish this?

Please do poke again or reach out to set up a meeting if there is timeline urgency.

Just checking, but would you accept PRs?

[bmann]

Forking the Bluesky maintained PDS and making a proof of concept would be the path forward. It’s pretty easy to run a PDS.