Potential use of First Party Sets for Single Sign-On

[johnwilander]

IsLoggedIn is meant to let the browser reason about where the user is logged in. A special case of that is single sign-on (SSO) within one organization. Issue 28 on First Party Sets tracks the addition of a mandatory purpose string for each domain in a set. One such purpose can be SSO.

A potential integration between IsLoggedIn and First Party Sets could be the SSO site telling the browser that "IsLoggedIn set for my domain should mean IsLoggedIn for these other domains in my set." The browser could then reason about all of them, both for logged in and logged out state, and apply whatever other policy it has for the whole set as being logged in. Browser UI could show the user as logged in to the set and even highlight the domain that carries the SSO main state.