Missing interactions in sign up flow

[dickhardt]

https://fedidcg.github.io/FedCM/#use-cases-sign-up is very sparse in its user experience and selection of claims from the IdP. It seems to imply that name, email, and picture are all shared. There does not seem to be any mechanism for the RP to indicate which claims it is interested in -- or for the user to decide which claims to release.

[npm1]

This one is tricky because the browser cannot inspect the contents of the ID token and hence cannot guarantee which information is shared and which isn't. That said, I do think it is worth thinking about this more to enable custom selections of information that is being shared. Even if this means trusting the IDP to share only the information requested by the user, as that seems to be the status quo nowadays.

[yi-gu]

We recently proposed the Fields API that allows RPs to control the disclosure UI. Would this address the initial problem?

[tttzach]

We believe the original request is resolved with the fields API, please feel free to reopen if you feel there's more to address.