<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">To be clear, I think it is arguable that IDPs are indeed tracking. They are corporate mandated and/or user beneficial and may have privacy policies in place, but if the goal is to stop information sharing about the user then ITP is directly counter to federation goals.<br class=""><div><br class=""></div><div>I think the language from Apple’s blog post clarifies that federated login is a specific use case that they have made allowances for in the past and likely will continue to do so. What will save the industry tens of thousands of man hours is to figure out where the line can be draw between user-beneficial tracking and privacy-violating tracking, and how federated login can stay on the right side of that line. </div><div><br class=""></div><div>I can also totally understand Apple wanting to be tight-lipped around this, as to not give privacy-violating trackers ideas on how to continue operating. For that reason they may unfortunately be happier engaging with individual companies (I didn’t engage with Apple previously on this topic).</div><div><br class=""></div><div>-DW</div><div><br class=""><blockquote type="cite" class=""><div class="">On Jun 6, 2018, at 2:40 PM, Vittorio Bertocci <<a href="mailto:vittorio.bertocci@auth0.com" class="">vittorio.bertocci@auth0.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration: none;" class="">Yes, the analogies with last year's initiative are strong... but I seem to remember that after an initial coordinated effort, things broke down into individual companyX->Apple engagements. However things did get better.<br class=""></p><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration: none;" class="">As far as clear ask, I like David's language below: "how federated login sites can avoid being classified as tracking under ITP". What do we think?<br class=""></p><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration: none;" class=""><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration: none;">On 6/6/18 12:18 PM, Mike Jones wrote:<br class=""></div><blockquote type="cite" cite="mid:BL0PR00MB029274DC3D70118EEBC3F163F5650@BL0PR00MB0292.namprd00.prod.outlook.com" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration: none;" class=""><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class="">For what it’s worth, the OpenID community successfully engaged with Apple last year to prevent them from breaking SSO when iOS 11 was released. Apple added the SFAuthenticationSession API in response to the feedback provided. It’s probably possible for us to engage to prevent breakage again if there’s a clear problem definition and ask.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""> <span class="Apple-converted-space"> </span>-- Mike<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(0, 32, 96);" class=""><o:p class=""> </o:p></span></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="color: windowtext;" class="">From:</span></b><span style="color: windowtext;" class=""><span class="Apple-converted-space"> </span>Openid-specs-ab<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ab-bounces@lists.openid.net" style="color: purple; text-decoration: underline;"><openid-specs-ab-bounces@lists.openid.net></a><span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Vittorio Bertocci via Openid-specs-ab<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Wednesday, June 6, 2018 12:05 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>David Waite<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:david@alkaline-solutions.com" style="color: purple; text-decoration: underline;"><david@alkaline-solutions.com></a><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline;">openid-specs-ab@lists.openid.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-ab] ITP and OIDC session issues<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><p class="">Thanks David.<o:p class=""></o:p></p><p class="">Unfortunately server side session isn't an option for the JS SDK use case, where the app might not have a backend (and even if it does, enlisting it to acquire and renew tokens to be used by the JS frontend would entail adding legs to the protocol).<o:p class=""></o:p></p><p class="">About your conversation with Apple: would you be able to keep the list updated on what you learn from them? I would be happy to join the conversation and articulate the SDK use case, if that helps.<o:p class=""></o:p></p><p class="">Use of iFrames for renewing tokens has never been trouble free (the zones in IE Brock mentioned in a different branch, disabled 3rd party cookies etc) but this change would make the problem far more ubiquitous, to the point that standard workarounds (don;t disable 3rd party cookies; etc) will go from controversial to unfeasible.<o:p class=""></o:p></p><p class="">Thx<o:p class=""></o:p></p><p class="">V.<o:p class=""></o:p></p><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">On 6/6/18 10:58 AM, David Waite wrote:<o:p class=""></o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi Vittorio,<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Yes, Apple seems to be further moving from a model where all state is isolated not just on the origin of the content, but segmented on both the top-level URL bar location and the remote origin, e.g. a (local location, remote location) pair.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">They had this blog post about the change: <a href="https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/" moz-do-not-send="true" style="color: purple; text-decoration: underline;" class="">https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/</a><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The option to prompt the user for storage access that apple has provided should only prompt once per site (hopefully), but can only be triggered once the user has interacted with that site, e.g. clicked on the iframe. So prompting is likely not only a bad UX from prompting, but would require the user to interact with a component that isn’t providing obvious value.<o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The RFC is for the session access API that they have implemented above, prompting the user and requiring user interaction to use.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hopefully it is not too self-serving to note that the DTVA proposal uses back-end API to coordinate session management, so it should not be affected by this change.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">As a second point, I reached out to the web evangelist at Apple for clarification on how federated login sites can avoid being classified as tracking under ITP. In particular, it seems a fully transparent SSO (without user interaction with the IDP site) may cause the IDP to be classified, at which point future redirects for SSO will get a (RP, IDP) segmented state, with the user appearing unauthenticated and the browser looking like a unique browser. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">There are a lot of technical, security, and user knowledge/empowerment reasons to always have an IDP interaction on SSO, but it is a behavior that a lot of deployments strive very hard to avoid.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">-DW<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">On Jun 6, 2018, at 9:53 AM, Vittorio Bertocci via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" moz-do-not-send="true" style="color: purple; text-decoration: underline;" class="">openid-specs-ab@lists.openid.net</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 9.5pt;" class="">Hi all,<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 9.5pt;" class="">We have been having issues with renewing tokens via invisible iFrame in our Javascript SDKs in the latest version of Safari - and yesterday's news about ITP 2.0 seem to suggest that the new default on Apple devices will be equivalent to disabling 3rd party cookies, which AFAIK breaks OIDC session management... and/or start displaying dialogs warning the user that they are being tracked at every operation.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 47.25pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span style="font-size: 10pt; font-family: Symbol;" class=""><span class="">·<span class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 9.5pt;" class="">Did anyone else experience similar issues?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 47.25pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span style="font-size: 10pt; font-family: Symbol;" class=""><span class="">·<span class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 9.5pt;" class="">What are the WG's thoughts about whether this calls for a revision of how session works in OIDC?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 47.25pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span style="font-size: 10pt; font-family: Symbol;" class=""><span class="">·<span class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 9.5pt;" class="">There is one RFC for WebKit that could provide an alternative location for the session, detailed<span class="Apple-converted-space"> </span><a href="https://github.com/whatwg/html/issues/3338" moz-do-not-send="true" style="color: purple; text-decoration: underline;" class="">here</a>. Did anyone consider it? Any insights?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 9.5pt;" class="">If the issue is confirmed, that will make use of OIDC session and related token renewal machinery unfeasible on Macs, iPhones and iPads. And without official guidance, that will likely spur a cottage industry of custom solutions. I hope we can come up with guidance that addresses the problem before that happens.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 9.5pt;" class="">Thanks in advance for your insights<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">V.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">_______________________________________________<br class="">Openid-specs-ab mailing list<br class=""><a href="mailto:Openid-specs-ab@lists.openid.net" moz-do-not-send="true" style="color: purple; text-decoration: underline;" class="">Openid-specs-ab@lists.openid.net</a><br class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" moz-do-not-send="true" style="color: purple; text-decoration: underline;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p class=""></o:p></div></div></blockquote></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div></blockquote><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration: none;" class=""><br class="Apple-interchange-newline"></div></blockquote></div><br class=""></body></html>