Tenant Beta (relying party)

S0 · capability probe

detecting…

origin check

server sees

https://lramalho.work

browser sees

…

S1 · the problem — embedded session

Embed the IdP widget in a cross-site iframe and see whether it can read the IdP session. First sign in at the IdP top-level, then load the widget here.

mechanism: naive 3P cookie CHIPS (Partitioned) Storage Access API Load widget

S2e · OIDC universal fallback

Promote the auth origin to top-level, then return with a signed token carrying both the real identity and the pairwise H(personId, tenantId). Works on every browser, including iOS.

Sign in via redirect Sign in via popup

S2d · FedCM (browser-native)

Browser-mediated account chooser, no third-party cookies. Chromium-only today — absent on Safari/Firefox, where this falls back to OIDC.