Skip to content

feat: Enable FoD login via SSO in fcli - #1160

Open
SangameshV wants to merge 1 commit into
dev/v3.xfrom
poc/v3.x/fod-sso-auth
Open

SangameshV wants to merge 1 commit into
dev/v3.xfrom
poc/v3.x/fod-sso-auth

Conversation

@SangameshV

Copy link
Copy Markdown
Contributor

Adds fcli fod session login-sso command to authenticate through a Chromium-based browser or a supplied SAML assertion. Supports custom FoD API URLs, browser selection/profile options, and named sessions.

Assertion file reads are size-bounded, and SSO URLs are normalized to include exactly one saml=1 parameter.

FoD SSO Support in FCLI: Frequently Asked Questions

Why does the SSO flow support Chrome and Edge?

The flow reads the SAML assertion from the completed login page using the Chrome DevTools Protocol (CDP). Chrome and Edge are the browsers explicitly supported by the current implementation.

Which Chromium-based browsers may work?

Chrome, Edge, and Chromium are the strongest candidates because the implementation is built around CDP. Brave, Vivaldi, and Opera may also work when launched using --browser-path, but they are not explicitly detected or tested, so compatibility should not be promised.

Can Firefox or Safari work if the user provides the executable path?

Not with the current implementation. The --browser-path option changes the executable that fcli launches; it does not replace the CDP-based automation. Supporting Firefox or Safari would require a browser-specific automation backend.

How does browser discovery work on macOS, Linux, and Windows?

  • macOS: fcli checks the standard Chrome and Edge locations and includes Chromium during automatic discovery.
  • Linux: fcli searches PATH for Chrome and Edge and includes Chromium during automatic discovery.
  • Windows: fcli checks the standard Chrome and Edge locations during automatic discovery.

Users can provide another executable using --browser-path, but compatibility is not guaranteed.

What if no compatible browser is available on the fcli machine?

The user can complete SSO in a browser on another machine and provide the assertion using --saml-assertion-file or standard input (stdin).

Are there popular alternatives on macOS and Linux?

Safari is a major browser on macOS, and Firefox is a notable alternative on Linux. This makes them relevant candidates for future support, but general browser-share data does not indicate how many fcli users require them. StatCounter's macOS and Linux charts provide directional market-share data only.

What is the recommendation?

Keep the current Chromium-based flow and document its limitations, including the assertion-file workaround. If customer demand justifies broader browser support, add Firefox and Safari through separate automation backends so the existing Chrome and Edge flow remains unchanged.

@SangameshV
SangameshV requested a review from rsenden November 4, 2026 16:26
@SangameshV SangameshV self-assigned this Nov 4, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant