<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Breno wrote:<br>
<blockquote
cite="mid:f98165700902151408v52cad342lc17bd7e045409611@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<div><br>
</div>
<div>Ok. In the interest of expediency, we could at this point define
only ui.mode=popup which is extensible in principle without introducing
any new other use cases at the present.</div>
<div> </div>
</div>
</blockquote>
<br>
OK, let's just agree that mode=popup implies 450x500, and there may be
other modes defined in the future.<br>
<br>
Will this work for your mobile users? The puffypoodles example looks
good on my iphone, so I'm thinking that we'll just use mode=popup for
desktop browsers and for advanced smartphones.<br>
<br>
<br>
<br>
<blockquote
cite="mid:f98165700902151408v52cad342lc17bd7e045409611@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<div><br>
</div>
<div>I agree that we shouldn't have too much going on simultaneously
with the popup. However, it may prove useful for the RP to provide some
context "before the popup opens and the RP screen goes dim".</div>
</div>
</blockquote>
We can add some text that describes this, however I'm not sure if this
is really necessary, and could just make the overall experience heavier
and wordier.<br>
<br>
<blockquote
cite="mid:f98165700902151408v52cad342lc17bd7e045409611@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<div> </div>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">
<div class="Ih2E3d"><br>
<br>
<blockquote type="cite">
<div class="gmail_quote">
<div>Should we also cover the case where the parent window is
closed
before authentication is completed?</div>
<div><br>
</div>
</div>
</blockquote>
</div>
Ah, I hadn't thought of this case. </div>
</blockquote>
<div><br>
</div>
<div>This can be addressed as follows:</div>
<div><br>
</div>
<div>When the user completes the authentication and is returned at
the RP, the RP should proceed as follows:</div>
<div><br>
</div>
<div>Check if window.opener.location is defined and within its realm.
If so, it should close the popup after ensure that all side-effects
(set cookies, etc) that follow the login operation have completed.<br>
</div>
<div><br>
</div>
<div>If window.opener.location is not defined, not accessible
(attempt to read it throws a security exception, for instance) or not
recognized to be part of the RP's site, then the RP should try to load
its normal landing page for full-page redirects.</div>
<div> </div>
</div>
</blockquote>
Sounds good!<br>
<br>
Allen<br>
<br>
</body>
</html>