{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2637","labels_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2637/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2637/comments","events_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2637/events","html_url":"https://github.com/mozilla/fxa-content-server/pull/2637","id":91356268,"number":2637,"title":"[PROPOASL] SSO: Support to prevent asking password again to already authenticated users on supported reliers","user":{"login":"renoirb","id":296940,"avatar_url":"https://avatars.githubusercontent.com/u/296940?v=3","gravatar_id":"","url":"https://api.github.com/users/renoirb","html_url":"https://github.com/renoirb","followers_url":"https://api.github.com/users/renoirb/followers","following_url":"https://api.github.com/users/renoirb/following{/other_user}","gists_url":"https://api.github.com/users/renoirb/gists{/gist_id}","starred_url":"https://api.github.com/users/renoirb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/renoirb/subscriptions","organizations_url":"https://api.github.com/users/renoirb/orgs","repos_url":"https://api.github.com/users/renoirb/repos","events_url":"https://api.github.com/users/renoirb/events{/privacy}","received_events_url":"https://api.github.com/users/renoirb/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-26T20:36:18Z","updated_at":"2015-07-02T22:58:58Z","closed_at":"2015-07-02T20:55:32Z","pull_request":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/pulls/2637","html_url":"https://github.com/mozilla/fxa-content-server/pull/2637","diff_url":"https://github.com/mozilla/fxa-content-server/pull/2637.diff","patch_url":"https://github.com/mozilla/fxa-content-server/pull/2637.patch"},"body":"How about separate, trusted+supported,  web application could just \"log you in\" without asking your password more than once. a.k.a. SSO\r\n\r\nThe following patch would make FxA able to give an OAuth2 one time `code` string so a configured relier would be able to get an OAuth `Bearer` token.\r\n\r\nIdea is that each relier could then use the token, ask a \"source of truth\" (i.e. `fxa-profile-server`), the relier could then make sure a user exists locally and start a session. This has to be done in two separate components. [An initializer JavaScript module](#An initializer JavaScript module), and [Set in place two HTTP handlers on web app relier](#Set in place two HTTP handlers on web app relier)\r\n\r\nTo see the idea in action, [see this video](http://www.youtube.com/watch?v=rutwd1Z_1TE) where you'll see two separate wikis, on different domains, ensures the session state is in sync with FxA.\r\n \r\n[![Synchronize session state accross separate web applications](http://img.youtube.com/vi/rutwd1Z_1TE/0.jpg)](http://www.youtube.com/watch?v=rutwd1Z_1TE)\r\n\r\n## More notes about the feature\r\n\r\n* [this comment](https://github.com/mozilla/fxa-content-server/issues/1386#issuecomment-51381907)\r\n\r\n## Dependencies\r\n\r\n### OAuth server patch\r\n\r\nref: mozilla/fxa-oauth-server#279\r\n\r\n### An initializer JavaScript module\r\n\r\nRefer [to this this **gist**](https://gist.github.com/WebPlatformDocs/fe3149c60d6ed95c7e16)\r\n\r\n### Set in place two HTTP handlers on web app relier\r\n\r\n* Each web application has to be registered to the OAuth server as both: `{trusted: true, canSso: true}`\r\n* Backend has to support reading from a  \"source of truth\" (i.e. `fxa-profile-server`)\r\n  * If FxA has no session, ensure relier web app kills any session (done through [JavaScript initializer module](An initializer JavaScript module))\r\n  * If FxA has session, it MUST match session it has locally\r\n* Ensure possible user data changes are reflected on relier web application locally\r\n\r\n#### PHP Backend strawaman\r\n\r\nThe following is planned to be factored out as a PHP module so that other systems would take care of the specifics the  [JavaScript initializer module](An initializer JavaScript module) would trigger via xhr HTTP calls from its iframe.\r\n\r\n* [FirefoxAccountsManager class](https://github.com/webplatform/mediawiki-fxa-sso/compare/master...webplatform-sso#diff-df6204a5520d4e71eaa9ebfa75e6034eR1)\r\n* [a very rough (clumsy) attempt to handle session based on data from profile server](https://github.com/webplatform/mediawiki-fxa-sso/blob/2eff4350d6f09445fa5a9b0ded43d170c43409b7/includes/WebPlatformAuthHooks.php#L241), the block at `if ( is_string( $state_key ) && is_string( $code ) ) { /* here */ }`"},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/comments/118188444","html_url":"https://github.com/mozilla/fxa-content-server/pull/2637#issuecomment-118188444","issue_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2637","id":118188444,"user":{"login":"renoirb","id":296940,"avatar_url":"https://avatars.githubusercontent.com/u/296940?v=3","gravatar_id":"","url":"https://api.github.com/users/renoirb","html_url":"https://github.com/renoirb","followers_url":"https://api.github.com/users/renoirb/followers","following_url":"https://api.github.com/users/renoirb/following{/other_user}","gists_url":"https://api.github.com/users/renoirb/gists{/gist_id}","starred_url":"https://api.github.com/users/renoirb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/renoirb/subscriptions","organizations_url":"https://api.github.com/users/renoirb/orgs","repos_url":"https://api.github.com/users/renoirb/repos","events_url":"https://api.github.com/users/renoirb/events{/privacy}","received_events_url":"https://api.github.com/users/renoirb/received_events","type":"User","site_admin":false},"created_at":"2015-07-02T22:58:58Z","updated_at":"2015-07-02T22:58:58Z","body":"Thanks for the feedback.\n\n\nI'm OK to not merge right away, i will find time to create relier module in\nJavaScript, and create backend PHP and Python modules too. With that in a\nusable state we could have concrete use cases\nOn Thu, Jul 2, 2015 at 17:19 Ryan Kelly <notifications@github.com> wrote:\n\n> Seconded, it was really great to see this come together at Whistler.\n>\n> We can't justify merging this to mainline without a compelling use-case\n> within the Firefox connected experience, but two notes:\n>\n>    - I'm really pleased to see that this was cleaner than the previous\n>    approach you took for SSO, that's a good sign of healthily evolving code\n>    - I'd be happy to consider any refactorings that would make this\n>    easier to maintain in an ongoing fork\n>\n> IIUC, the core of the experience here is just skipping the \"signin\" prompt\n> entirely for a certain set of reliers. I wonder if that could be useful\n> more broadly than just the sso scope you outline here. Worth thinking about.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/mozilla/fxa-content-server/pull/2637#issuecomment-118171409>\n> .\n>\n"}}