Poster: FedCM for Research and Education Erwin Kupris Munich University of Applied Sciences Munich, Germany erwin.kupris@hm.edu Tobias Hilbig Munich University of Applied Sciences Munich, Germany tobias.hilbig@hm.edu Thomas Schreck Munich University of Applied Sciences Munich, Germany thomas.schreck@hm.edu Abstract—The misuse of web technologies for tracking users on the Internet poses a threat to user privacy. Such technologies include third-party cookies and bounce tracking servers. Browser vendors and other stakeholders agreed to phase out some of these technologies in the near future. This impacts not only trackers and advertisers, but also legitimate usages such as authentication flows in identity federations. The industry aims to solve these issues via an emerging API called “Federated Credential Manage- ment“ (FedCM), transforming the login process into a browser- mediated flow. Our research focuses on how to improve the user experience of FedCM within multilateral federations, which are frequently used in the Research and Education (R&E) sector. Specifically, we suggest ways to filter the large number of Identity Providers (IdPs) commonly found in the R&E context and display them, while automating the IdP discovery process. We provided our suggestions to the working group, also considering user privacy aspects. Incorporating these changes into the FedCM API accordingly could pave the way for a privacy-preserving and user-friendly sign-in experience in R&E federations. Index Terms—FedCM, federation, security, privacy, academia I. INTRODUCTION The ongoing exploitation of certain web technologies for tracking poses a threat to user privacy and data protection. To mitigate these infringements, browser vendors have agreed to phase out some of these technologies. The most prominent example is third-party cookies, which are expected to be deprecated later this year. Bounce tracking, i.e., a specific chain of redirects invisible to the user, serves similar purposes. However, legitimate usages for these technologies do exist, which will be affected by this discontinuation. Federated authentication mechanisms fall into this category. SAML2 and OAuth are the most commonly used protocols for this purpose. Both employ redirect-based login flows that are nearly indistinguishable from malicious usage. Moreover, fed- erated applications often use services such as SeamlessAccess for discovering a user’s Identity Provider (IdP) [1]. To offer a comfortable user experience, third-party cookies are required. To prevent the breakage of these technologies, the Federated Credential Management API (FedCM) was proposed. It en- ables a secure, privacy-preserving, and dynamic authentication process mediated by the browser. FedCM is being developed by the W3C and has the status of a draft community group report. A working group with the goal of standardizing this API was recently established. The latest draft of the FedCM API is already implemented in the Chrome browser and experimental features can be tested in the Canary version. In FedCM, the browser acts as a mediator between Relying Parties (RPs) and IdPs [2]. When a user visits an RP, it can call the FedCM API by providing one or more IdP URLs. The browser then issues requests to the IdP to obtain information about user accounts that have an active session with that IdP. Afterwards, the browser asks the user to select an account and consent to the federated authentication in a mediated dialog. Upon selection, the browser issues a final request to the IdP that includes the session cookie of the chosen account. The IdP returns an opaque identity assertion to the browser, which is relayed to the RP, thereby concluding the FedCM flow. The current version of the FedCM API covers use-cases of social, bilateral federations, e.g., “Login with Google” or “Login with Facebook”. However, multilateral federations, common in Research and Education (R&E), typically have different requirements. Although Fe