erlend_shWorking to Decentralize FedCM
poVoqSounds good, but this FedCM seems to be basically a reinvention of Oauth2/OIDC. Even if it brings some minor improvements (credentials storage in the browser or so?), it seems dead on arrival given that there doesn’t seem to be a strong dissatisfaction with how OIDC works. Or am I missing something?
What you’re missing is that OIDC is innately centralized and FedCM, in particular thanks to this work, isn’t.
This is all building on or complementing the same underlying OAuth standards, like the CIMD spec that Emelia originally intended for adoption into Mastodon/ActivityPub to set the stage for decentralized OAuth, but it was never brought in. The AT protocol on the other hand adopted it into their decentralized oauth-atproto standard, which is on track to become a protocol-agnostic oauth-dweb standard.
Anyone who cares about decentralized software should be dissatisfied with how OIDC works. If you wanna use your primary fediverse account to log into other fedi apps, this work is for you.
OAuth Client ID Metadata Document
This specification defines a mechanism through which an OAuth client can identify itself to authorization servers, without prior dynamic client registration or other existing registration. This is through the usage of a URL as a client_id in an OAuth flow, where the URL refers to a document containing the necessary client metadata, enabling the authorization server to fetch the metadata about the client as needed.
OIDC isn’t “innately centralized”, thats just how the majority of people use it. And the same will be likely true for FedCM.