From ba08c9fe36c4c7c7a9f657cfcb3636482e775457 Mon Sep 17 00:00:00 2001 From: Richard van der Hoff Date: Wed, 27 Jan 2021 16:47:49 +0000 Subject: [PATCH] notes on and alternatives --- .../2858-Multiple-SSO-Identity-Providers.md | 29 +++++++++++++++--- proposals/images/2858-login.png | Bin 0 -> 12618 bytes 2 files changed, 25 insertions(+), 4 deletions(-) create mode 100644 proposals/images/2858-login.png diff --git a/proposals/2858-Multiple-SSO-Identity-Providers.md b/proposals/2858-Multiple-SSO-Identity-Providers.md index 981eb4bf..65877c00 100644 --- a/proposals/2858-Multiple-SSO-Identity-Providers.md +++ b/proposals/2858-Multiple-SSO-Identity-Providers.md @@ -94,6 +94,8 @@ of an object with the following fields: any of the above, but are expected to apply a sensible unbranded fallback for any brand they do not recognise/support. + Where `icon` and `brand` are both present, it is recommended that clients + which support the `brand` give precedence to `brand` over `icon`. ### Extend the `/login/sso/redirect` endpoint @@ -115,10 +117,6 @@ SSO flow option without any `identity_providers` as there is no method for a client to choose an IdP within that flow at this time nor is it as essential. -## Potential issues - -None discovered at this time - ## Alternatives @@ -131,6 +129,29 @@ for the server to deterministically always pick one, maybe the first option and old clients only auth via that one but that means potentially locking users out of their accounts. +### Styling information as an alternative to `brand` + +The `brand` field is intended to allow clients to style "login" buttons according +to the identity provider in question. For example, a mobile application might +show: + +![login buttons](images/2858-login.png) + +Some identity providers have very specific rules about how such buttons should +be presented, so a fine level of control is important. + +An alternative way to achieve this would be for the server to give full details +about the styling: icon, font colour, border colour, background colour, +etc. However, this soon becomes unscalable. For example, it might be desirable +to offer each logo at a range of resolutions to suit different screen sizes. +Likewise, some brands need different styling depending on the background +colour, so a complete second set of colours must be specified to account for +dark or light themes. + +## Potential issues + + * New Identity Providers added by server administators will be unbranded until + clients adopt support for the new brand. ## Security considerations diff --git a/proposals/images/2858-login.png b/proposals/images/2858-login.png new file mode 100644 index 0000000000000000000000000000000000000000..0d0a06f618c9416219ecdad9857462b33b6dfe8a GIT binary patch literal 12618 zcma*O1yq&M*Y1mg2vVB{$xSLLt#petQqtYsAt|*fN$CzLVbk4>bW2N@GzduD#s9nK zj`N){?l+EOFa-9ydDmKVuKCP&J-;2QDE}Vg#mg562nZM-q{KfWAUweaUl=IJ;5V=Q zlx)F&NKT?3R8YV_FBD@K0s6a&$4SJ4_IF3*#>WBVkVw6zI zXX5d%Fe6{h6qCUZUg@mo*OYST$n%x;xt2DXURNvd9h{kO@2*Ek_wg#@Gk+}cr%HVB zB2Y$(k|sJ3;@FmvmbQPim?32NRib}5PE6|5yL3}C<7}aAWsW`&>+{jd{XyxAAW>)_ zWDV`3g3Gf&$Yg3D3_?YPLnR7>Nx@K{R8&x^Kp5=*{+F&)L43TtS9eFgqfJMxB&Gjk z(FnqW^78VE%7P(E*o1`dEi7K==jV6#^+jpuaxLd0{5@J3^}XNrtu!5edH>h$fuL%R z)WM{HF{DdGL19!yT?|%OK4(qJ?;id2E9TFiKR>m2UKDQj;ZucRQJCKRJy>*KkF@?( zZZN^X7+BBi!B75kaImPPWPMQYo}HGKmO6pVNw#~{er#q&($%#V2?nVO95>IauEq=K zXzvJke&Ws#F5wWjw6rw0wl+SPuZh$A0PUV;78K0*^5toSBsF)cO}C>_u#}!2MOcoa zqT-t(d^}O@yN}As6?4{8Gc#X5N!p&gfJ)*~PzY_2y+p-^ii>~e6xY)W2st@9k0)dvM7+F6XZ6~GRTab}9a#zpM-M>K1R-(IW#F@C3wf1NCp8X;gQ{xJ;Zl=@wKb{3m+0C3oft6$dNge?B}-Po!AwErL3k#@GUbG)>>F2 z{?CS6Q>&Nf!N}H;owlckhK@$Ogtw~m*h&6!(FyD1OjHI} zg9;#+83m>pGHPdGvHGjRsJpuxF zNRh>RmgF1v=Bj4BR<^cVAel%(65ILSEP%`%A0HQSbaZq_eO@yC@}7f@2p!az^|R}p z{e84H@%3&r5ej8 zweiHd`49D&GDrJjsNY{_c|EU7@P4PMnliq(zkhP=#eegsYBit4?Pyuf#Kfe&gw0DG zDfs@Wo2%=ZGcQ}RY+^NvrlzL3g@wU*j>KvW4LUNSWNwUViQ38eq(aCb=JPRe_ZHo+ zbU#_MN2BK9AuLrJY`Yz7`+a%SaQ|=rH6x>#5?*Xv99YQs#Kg&kg~8kF zv$<*uTvSw48W5(qxPSp;!>(YAS7DtA%v#4ccaP)ux%(%x74@l9t+KLGN=mBTu;Pu` z2&sIgpq#QYE^>f>ef?WqU3Q5G?fwkCItyZl{A&6LzZ$ zwEm$XW02T87ykxZ;jdmS)Y?$LdzajF*vLpa)n!D(#l_V=*1j)>B@no9&}x2b4EFGk zPZd=Brl;+QSmh4ul8d&Nv_`MHz|bT?<|79@snHycQxNn}a@&Q&S-;nTLa7Tca9)b! zKW@KkzS{RCsYsJAFk0``@;Du^dtb%Nk)R82qY)0)U`hzr)heAi){Yz{$rwEGP%FVN zndUWZ7}Xope-o$|rK&5dr{wEudbrrYe|pRVi>y&}*myO|qSq^zpI!YW>nJf(Qz~KM;TCpwiImue z1jNfzpWO+YVQ;PGzkjC#a^5*=h5|KB0I6MTvmj|>!wmLQuI&~^7HCYe zPjs7GTQiuoY891~{MAY@;Hqp3pO^?xmDs2~_%n{ln@iM6bMo?xr_@kn--vfZ{}?AsyvOPsU=MO`Cy88z+9A!ry?jcD2au$=xl6@ zMcgEmO#Rv+L~2aX?{wUDQR^YRJ?KoY{);HABuPH%Cr-HSI8KCKE7{V-rcv-f{Z=T_ z0iyduHO96T>*(@K2&5{4*M$6g(@|gjYOPX$v9=La>rd+X<$vjqy@*tK71`0(%j5L7 z+?EY&Vl-o(Px9ArMgRJLC`p4DdLHwnb-1m)g7*D}ne?K^=&L{XuX2ggWP^5}WAB*L zkBtkioq%_3T;iTe^GL$x7&b_0HX^cUsRALnF%WD~@r|%Qe27^YsbN0Dyyqn|S;Iqg z8)w*m4#kW3znms6v0sYAEEx8nIVo|llNq>v<4voKsfQ&y`#AFr&i9*p%%d_#ZTP)j z0~$>?C+_rN1TQn<8FdtH)%A%|L1>AbY4!DN)-Wr~)Flw21gS}Y{WR|^HzoTXsrQ5u z+~=(u!BMNg)o2FYhI7`y07VLh8T;M1&!QmFJPLm zorKbM_t_SNz(tnk8`sr;2W_~24$%`&W~a0MtOWctZ`|=_d&g-(Ow{Vd_wSn(B~iD! z3+d6a&^o*%bl$9ZeOtdiKO%Y|XnUzt>4wzd0wxVBG%PiDBFstVtF}sLt3@8IEltD- z8_P-`%eoEcnyYTOPHOdJ-9fMSxqN|ynE6%68*wzVc9qZZjb&yjyOwZC`20oBG%W)( zCnFB#=|k}5{5a#tnD+kPXzi-X@CRYHVX7$yCzj7XSr<=R^NpRFck zJ|>@4vYxY^a(m@72nw@PdAD3RVr!B+Yl*iS+ypHoe|F6lQvl`#` z`7<~ln|IXVJ?{HtNH%v!ODxWVYQKe4gUoIg3b)M+n)A_BWznIT6kU<~C+WqVEf;M{ zJ(_H{!;;k+b4UvdiUp(ZwLZyawPIds!9#=;Ot_6+E%_bJe|vn5mM&Y%#d}IibnR!O z;hA{%x7GTqTi<{CoVi`?TaFns3&*h^#d;RTeN?0` z_+7#uX4dz)P?kQWBvYQl&9g9J4x8ZSY`BBh=ljFy>Qr5^e$`Q#8!UEaMR>)Qf_?6A-d-@jEX z(pg1MSi z?!bUpdNj;qWQ=Y2i?%4@U7?{7>V-6H2nmes_iu!bvTPBR8ZJzm4nxkfs!q9mFz4k{ zq2NI)$FuP~6LhjFEXb|)<$GCK5a~iV;Wq>Go37}|(4!61TQe)R#ak23r5#b@xgCgZlJFmy|&G`Hekt-!z z6YL#zfhu#qMTbx=lVI4q@1rtPFY~k5&}bZ9k9k*9f`F1H6mkR`A`BJJf+uDfLAvHs z$8?%r+zN`;3aUs_r^Ks#(Mi7|89`vEo@-b|7#os#Z&R@bFQR*^FUG<1%w=sXqie6) zdFpi$(t)ceHwl9b)BKmtY@;*wF{b{eJaQ2&A^!~9+wIijKkitgA$-R?Gq{etCYS^0 zI5lk8zDuv;mp08Qd`N2sA}l6#b`pJ2M@KFd88AiPz{>R5{?+hg>#^ZcLhHhXm8tL1 zmYka zJ=MD`&fy8@>7c3!loJ|8Z1cu}|yA>7|I7 zM{E1n-dCeDYeHI|2VA;`AQxKA*&QN_b`Ly1=_w5AuLsS;WfbY@awp7Do!!>>e2_M& zHD2iRo@CmI$Hj#DOuuv&D$&}spdR5 z`$6)JDXg&6p-}l_9|K)rQa0!7GnO0csqzXj8fL`1u<68f8-~E7Ik4@hJnecDS1`a+y3r+f_ao#PB z^&|+9#vx!ECfL{G3G&V(F^uikY?w(LBV;VB=T_FHhwUW{{K$o@F%(=qCFOPS7gHrv z^rFVni6Exh*1Rbyv`wG-i3s*l@he#r3%Uot#iPv28ya-1CXK z*B;U&Aow-SI{6mzp`y}q*GrUMG>(Kysj;lS@;i;V*F7b<9fDuHINI#DA$mr++PyTC zbhUsrwBwWUGeUvb-=|ld5Af;2aZ45V_;!;K^<1^0<9|;Ro9(8ol)U_9zDBx|`^^=K zl_(jxdD1&)BrTVj!>(?hkg~7}aMP2U>?AH7oJ=kYz~=I(XMXgVkLe6B$XWULMhiBD z{~aBEMQ*#KQ$>mD7gmhcd}Dy&S|FEHv++!87uFn>VA{r%VZRg+_NS4aWJS*XNDi>RTbN zs9Yt)x(|;})viD2J{Xx?wd`?_@!wTp^$*H!#5BP-d-3PgE2Sq>)Jo_&EKPMM#+E4s zeGzJ2oO0mqQrMrs;a=jFj!gNCg!WyD1oq9}(<^Jxo?K-<*s&IUsIb;{!+05)(lyQe zLn~QK*-D7jPC!)GluCx+JNu3bN-(A1jFi$Y3-ZSw8Jhf4EY120qfW`tOfMM3Mqx-W%4S zrROB(yYT|v-{W4Be7fV0Q+luc!+P=^_UllBFoN&)gBKnM)z0Y09eR6j?f>wz(Fynq zN7sL%wyX);c*nM3M$gUz4NiYP;<)9-YBqA|*jRzqqALUTvyZP|@jNCTtuPpFP{RP; z*2t!@H=%r;XjhQnNZQdeeIHBGS(Xn4<^~L4!h4OFU(;TCDo$q2I-c#3N~>={D6H~I zMh6bXB40`SDadoi#p{26L!VqV>@CKe#^r&|i|L6wc`3Vsj_ry9&t8eCv z7oITq#BL{9?7!SQeY^C+wa?6mVCjwpVTNgNL#F2}w1!AYkgV=as&jRQC1Shj<=E0T zdgiRqPRHionABvc=4tnFbfbdz9S0Xiq2sw~CH8MyR`tssUxdWmel!pDlNHor0qHmR_Ja#g6ZC z5}jw>HFhUCn{zSndLpwCRTDX9lBK5VL#cbD<&1dti11NQOwTT= zG4PAXOzEfg&L84xtm&iFZg71M174R%0i>tUR+V^vT{x6cAVY4Su)=wqA7P8GyS(^q zKu*x>AG*AmHM6Gcf3J#)jyg@ILfkU;8+=JKkV{g?L`aCuL47z0mP7=?+Ew)XPW!B_ zq_1PnX=$;|;&t6}^ytatLE4Xfux%%1xcWn$lQg&)VL$vEvOx-f3jT5nZXJmE z%<^R;jBWqZW&SfJo%r7O?^C{SJ!hn|9tujqO0RE!@HkjUmD6X?Oyb=`bZ_BSzhW8w zxrW|)bHPREVz%*wA6iBZ)~VvU%t}Ko$#rghA{{&^(=aS0f1mNWziGiG74W#O(O4p< zDA?nBVt!D4HZl^|?cEp^4s_~JJE~eVFo`Y)hblmx_4(KI?e>Z@qXe7Bt1_)}lrW&( z_>@b;zykQs*#j|$xFIw0M?r6Ha6WSLX$YB#jrwSS&lE<}n>-*Jo;oG{sGcqIU2Dw^ zF*do$vBs-gsttI|q~6MU(C#7SN^|l-!SovbSck|^urar?`J_K3rE|W<#{~|=X(djB zlQ%T{?7f|E#5%9U8C5A~uxL_f~MaBP@PXE{O$>TACai`3a`a2O#GQoLL zpXMhG71Z6bIkSaH6eZMMIbv|7$o({j5ZD66hI?X2-6*pHfLI_y0*SvDNen8@ZyLI6UR(_a54Thftg~iYRQhvU}gZ3#*`>h z@b}^6H!HFc^1~!9h^xf#0aIp)554w&w>6(ykmDqu(tHfZ#fWFFcb;U^qwJ2sy~Y!pRyu=qu)N zy6k*gCc{xxFgI|*!lPO9qU3%8;mOto=6gLW(tCmwu2P&1A9zCO% zrW8+|z6{bU`5imk0U@ek5H)`-%NdPbvObT8OC~RLX5=zdw>M^?;@otbcA!31 zY_Lj-h_-ePZk6`uBnL^1CYiIFn6uE|gH4lH+h^o_kZC8G$`WcgUesXv)&E*;seTls z8+t!Cp3){(XDki%E&;Qa{Ct1ti)z~BH2xS8pvDEYeI%Sapy@(T~Mwn-z^R{891W+LV@qrSt5>UUmV6Nj-)?CQdGeNmGX zG(5Tr`&m&@S~?(_j%(-Vp0|2e31zG(cgw<8wsJacogPi1y>IVtd(QEvAG799>u(wq zFB=0=r{Tnhw{=4OeKstvobPfp$WC52@xT@c4ILVvz=isgeOQSrcpcZziMSX9Ez_@( zdi;2VLk8cs49mDg5mu>5GzRwlfJ{T45UG5*Z5Z&MrC7`Eyps81?7rK>vyYsk^X>KO z{!#a&wpc$8myrMqK53JFZ=sUGLy1;J-~L6narYR1mZD3?2e$|U z0W><6o#|h!Z;MK1a~0TejMR_MJuRk+DriWQiiBqmR@*-u=OvXFLtFb~q$3hksuK3d zu_9k``M)JAT_XRJ`$Gm>E+y$LxZ6pj>EYn$iiVxy_*vC+Z>~ zKrS9x05z%9u0Bu_IBK7*{os?m{Oj8_>un&tKkk`)$?G2_blG_7WFknE&);6ermJVe zG-yj_v7Wm_BSohQQf`IhH#n{oq3u7#qke{p9HGf&s~1hz6xDUW^3}P~>^v>HUH>8e zIqWI|UPqR{o)*|o6K?7DeT76{FFek>%30Tsg$=`K28VxJLEc3bDN8}ND>{W^dOFD= zN05#^HJJb}#_>pK)gl&>Y?)GT9I<RYKf1JkI?kd zh5{d@i|?peOkN%n3%Eu9rHAviHYDG^eOvU{PR~UiNHU@d%NhIi3pQ=}4Lqt75Fd{G zS!yDTGTTUh-G?6Y^QW|Y2LHf(jTL>(qbH%|<;7p34yWVd!cQIMHUy>upda+PQ#D$> zuJhCsf!xZ-$(iWu`_0eKV-H4@@U1%z$RCOhNlNBo2Xwr#Bu=LP|Bw%L>lI=!ZD1t- zs<9#@WI?xKPEJi71g5u$t}eN0)wQ&$1PWVd4mlWMIq(;O_w)|%9KHi5+Zms~f>p`z z{;Sb|2)qNlX^0YD5HKl2C~kj0=j7pu`eX_m|9Wkf4BvYXR2=B{?MAYirqk z@4a~W_+GQHY$cmz7;OIh2F%Z$|JCpR znCh*qg7WFS5+)|JfOTj-=_LUUu>KpOtC_mip1tW3z!WrJ%xK+C3fk*WYK)`LcjE*i)e|@zcRpou-TGp`jGQ)H4HMjLI z$f0y-GIZ}uJXni3m$)RKif#mCYu&=Yz(7MDW2N;RJ9w|Gk`lISQ#u$E;4k_Vd`@v6 z-(71x*BRw=PObk61yDMCu77^_5bEVMHl_&Ou3~|JAR{B&H!ZF1W9nI5J(QG`Xw+EZ zgXAz8PT{his|*7CfnEc}mwGCYz3a)`tjhcJnK`en?(V}oJ%CBR=sYR+_{D!dCI(FE zD35fL!GsEsAX~$!eJNa4{UF4xtv*9%z}k0Pba)=ce~NN_ef{X3=gTC1)X^auzr<0` z1pESk3xMN{j#a)4_A|As5(6Wn$K{fn|4EH@_pftLfe!uX+FI^KTON=;(BmJ8_c(=6>>wT~$IqX!Q&c|)X#N4xkDo8$eICRK8BGLv3wT5~hM zmmozdkKNWcbzM}f6oxQS;H3&ZT#tJE+bwwK`iID~B_k(?s)3IK6%6PV6H~WoRZtTI zggibWAvQ7by`v*LsB3Y5J#^uhIc1RmsR0+PR4p95O_wLeO7_nopz`qWcw7?m8qL_) z*f+_t&9|q6AeqpKUc_83e`Y16L;%3mW7Qfjp7>GaxG4=B^4@(opfA2Wf*K$ho)t`f zP*NJF-F9|!oBZ|5U5Qd#9^5!v5vE)qzv|lb&i$AYL=uJK(zC_u_N4F6Vnf`>h`iwK zv6!c)=cfk8%?+OqY@0bV=@p-t9zz2P$lpJ6T|&2ALW%$_@$&MzatA04NZRwif5Ei+ zRvzwFstme<%~dUC9-*9$=M)! z70B(u+#As$Me?W+n}u2+DwwUO-{9qd7f~845zSUKZzhEQ_^}a0s9SG5kpxf!pq1yB zm&zYMc6MP2@t1jMdGCo50a0-#amKLe)1^mUCM4I&gL8qab|32AW`K10che}Ku&77*B2`= zjs{`~JzUkj0`J-$1m;!2qrAuzpbVyiZ`O5QnJMV}bq81jy!NG?9PNGCUvu^M5uN)N zYpzWNjV}#TLM>r|UV>hPBddbtB%99o(9!(1tkzmne)_0YJAtT=-kd4Z$roQKght$2 z&&XzeXaHn~TJ*X?rZLs=c*{j#fp(y7r>vpzC?JLt?Kl;AxiVdePebzV+j3$3Y$VyPJxtf{U zXV8OPUyu5Z6swjz?y}v30~1iP0p)hKPVtcBvOiPdy!#RK4L~#!bv;oN2YY}}0lQ zfb{dLtYim$%JuOL80ury1B!4KY3CIHY7^&63`9i4M zB`JwKtK&unYAYex1IUftot-QY(*JZTllV8SYd^zuVMut@Q#gt4NREE`gok%+`8UI} zL_W5k%w8DCVHyq~qYHa7GR%I6h9s*1Iti2+0M4*@`d;i!;}H<7UEWv#&)ShbBI#4w#h=%@bCR;3|e{{6Z zobzBEqyASi;>OYqZw}8 zzKH2vU~s=8UZPp`5fF}Gu>%7GkN10fdygqCB_$>6e@t7N-2J-%IO=c5hO2+GZSpcQ zGFSDp`xpVtJ# zpcOYQEDVA%&|we=AqT$;EcU?=!Loc-jj329Y=v%69Y~3pgf%oQQL}+Mg~lyWB3-2h zBn;u=;sTV73ed5D`T0s(T6~5c0Ueau>G%SMM%Yw(}Ep4RPy!6*T*g;x_6H zsNi=1vkc3zKU{oA{`pUZJ>mNyextGqOFDTy?qwwH9j@+>CFt9g@1}bQr>3U50p>U`GV;B; z`n=Kv*lg%%9%+Gi&uUaPDMYo0dvU48k4ChEe-Z`!B;vrQU=B<&uEg{EZ=n2tkU7t4 z&C)+jjNMEdC+>KKp=`PbMhvVNO%ifnd2`oB4l@$cIEE$pLAXEqdp4QSD1eL0DUk;#mn7QNq z6ZtX#$|P|i-GIye-#rljUwt@0(<4m}1sk<=*fe#I7X|vAZFl6qf281n!tEo+1Iz34 SWANb!gbxz(;$@=xU;ZCi^u5sl literal 0 HcmV?d00001