-

2025-02-18 20:41:39

alisynthesis@io.waxandleather.com

What's the reason to not have a Fediverse-wide SSO (single sign-on)? Is it simply a matter of it not having been done, or is it that it violates the principle of decentralization? Or ??

#fediverse

show all 7 comments

2025-02-19 09:00:47

Jupiter Rowland

jupiter_rowland@hub.netzgemeinde.eu

@Alison Wilder Because if you want full-blown user rights and all the same features as a local user on all over 30,000 Fediverse instances, you need a local user account on each one of them.

This means two things:

If you come over to the Fediverse for the first time, and you register your first account on Mastodon, you automatically also register an account on 30,000+ more instances.
If you decide to host your own instance of whatever, and you spin it up for the first time, your instance immediately creates tens of millions of user accounts. One for everyone who has ever joined the Fediverse. Because anyone may decide to come over to your instance and use it, just like so.

For one, this is utter overkill.

Besides, this is technologically impossible. This would require all Fediverse instances to know all other Fediverse instances. With no exceptions. Like, if I start up my own (streams) instance for the first time, and half a second later, someone on the other side of the globe starts up a Gancio instance, they would immediately have to know each other. And all the other instances in the Fediverse.

And, of course, it would require a newly-launched instance to know all Fediverse users. Again, with no exception.

How and from which source are they supposed to know?

That said, there is a single sign-on system for the Fediverse. It's called OpenWebAuth. It was created by @Mike Macgirvin 🖥️ (creator of Friendica and all its descendants) in the late 2010s already for now-defunct Zap, a fork (of a fork?) of Hubzilla which, in turn, is a fork of the currently hyped Facebook alternative Friendica. It was backported to Hubzilla in 2020. Everything that came after Zap, including the still existing streams repository, got it, too.

However, first of all, OpenWebAuth is only fully implemented on Hubzilla, (streams) and Forte. Plus, it has client-side support on Friendica. This means that Hubzilla, (streams) and Forte recognise logins on all four, but Friendica doesn't recognise logins from anywhere.

As for Mastodon, OpenWebAuth implementation was actually developed to the point of an official merge request in Mastodon's GitHub repository. As far as I know, it was rejected. Mastodon won't implement OpenWebAuth, full stop.

Besides, it doesn't give you all the same power as a local user. You can't log into Friendica, go to a Hubzilla hub and create a wiki or a webpage or a CalDAV calendar, just like so.

OpenWebAuth is only for guest permissions. Because on Hubzilla, (streams) and Forte, permissions are everything.

For example, let's assume you have an account and a channel on (streams). Let's also assume that your (streams) channel and this Hubzilla channel of mine here are connected. Furthermore, let's assume that I've decided to only allow my own full connections to see my profile.

If you're logged out, and you go to my profile page, you see nothing.

But then you log in. And you come back to my profile page (provided your browser is configured so that the Hubzilla hub that I call home is allowed to create cookies). My home hub recognises your login on (streams). It identifies you as you, as one of my contacts. Thus, it identifies you as someone who is permitted to see my profile.

And all of a sudden, you see my profile.

That, for example, is what OpenWebAuth is for.

#Long #LongPost #CWLong #CWLongPost #FediMeta #FediverseMeta #CWFediMeta #CWFediverseMeta #Fediverse #Friendica #Hubzilla #Zap #Streams #(streams) #Forte #SingleSignOn #OpenWebAuth

2025-02-19 15:26:24

Alison Wilder

alisynthesis@io.waxandleather.com

@jupiter_rowland @mikedev

Stellar answer, thank you so much!

It completely makes sense that having one account on all servers is a hard no. :D

My question stemmed from a wish, as these sorts of questions usually do -- I wish I could use my same Mastodon account to sign up for Pixelfed and other Fedi platforms.

It sounds like OpenWebAuth was created to do just that. Too bad it's not being more widely implemented, although I'm sure there are *reasons* why it's not. :)

2025-02-19 15:33:21

Lime Bar

limebar@mastodon.social

@alisynthesis @jupiter_rowland @mikedev
Fwiw I think pixelfed supports "sign in with Mastodon" already.

Which is all anyone really wants when they say sso. Nobody wants 30000 accounts. They want 1 account they can use at the handful of instances they choose.

2025-02-19 16:01:38

Alison Wilder

alisynthesis@io.waxandleather.com

@limebar haha, yeah, I definitely didn't mean GIVE ME ACCOUNTS ON ALL THE SERVARS

Although I do appreciate that, if you know a lot about something, people's questions often have assumptions that are out of line with reality. Which my question probably did!

But shit, it turns out the main thing I want exists, which is to be able to sign in to Pixelfed with my Mastodon account. Not sure how they're actually related, but maybe I'll try it when I try Pixelfed. Thanks!!

@jupiter_rowland @mikedev

2025-02-19 16:13:02

Lime Bar

limebar@mastodon.social

@alisynthesis @jupiter_rowland @mikedev

jfyi - https://pixelfed.blog/p/2023/feature/introducing-sign-in-with-mastodon-streamlining-sign-up-and-login-on-pixelfed

2025-02-19 22:05:21

Jupiter Rowland

jupiter_rowland@hub.netzgemeinde.eu

@Alison Wilder

It sounds like OpenWebAuth was created to do just that.

Nope. OpenWebAuth was created for identity recognition for guest permissions, not for full user permissions.

OpenWebAuth lets me visit a connection's profile and their posts, and I can see it because I'm recognised as someone who is allowed to see the profile and the posts. (Imagine you could define that Alice is allowed to see your profile, but Bob isn't. This is possible on Hubzilla, (streams) and Forte. But it requires OpenWebAuth to identify you.)

OpenWebAuth lets me post directly to a connection's "wall" by visiting their channel on their instance. (Imagine you could send someone on Mastodon a DM by visiting their account on their home instance and posting right there. As alisynthesis@io.waxandleather.com, no matter where they are. This is possible on Hubzilla, (streams) and Forte. But it requires OpenWebAuth to identify you.)

OpenWebAuth lets me post to a group/forum on Hubzilla or (streams) by visiting that group/forum. OpenWebAuth recognises me as a member and allows me to post directly to that group/forum.

It is this what OpenWebAuth was created for.

But OpenWebAuth does not let me go to e.g. hubzilla.monster (where I don't have a channel) and post away as jupiter.rowland@hubzilla.monster. This is not how it works.

If Mastodon supported client-side OpenWebAuth, you couldn't go to hubzilla.monster and post as alisynthesis@hubzilla.monster or do other things that require alocal account either.

#Long #LongPost #CWLong #CWLongPost #FediMeta #FediverseMeta #CWFediMeta #CWFediverseMeta #Fediverse #Hubzilla #Streams #(streams) #Forte #SingleSignOn #OpenWebAuth

2025-02-19 22:08:31

Jupiter Rowland

jupiter_rowland@hub.netzgemeinde.eu

@Lime Bar

Fwiw I think pixelfed supports "sign in with Mastodon" already.

Nope again. "Sign in with Mastodon" is a smoke screen.

What it actually does is create a brand-new account on that one Pixelfed instance with your Mastodon short name ("limebar") and your Mastodon login password.

CC: @Alison Wilder

#FediMeta #FediverseMeta #CWFediMeta #Fediverse #Mastodon #Pixelfed #SingleSignOn