The installer offers sign-in through the identity provider, then asks for a client id with no default and no way of finding one. Leaving it blank turns the feature back off, so in practice the answer is always no and the button is never offered.
Endpoints in the NDP realm do not each need their own client: the platform's public client works for any of them, with the realm URL the installer already suggests as the issuer. Answering yes should be enough.
The installer also leaves sign-in off even when a Federation registration carries a client id, on the grounds that the registration names the realm but not the identity provider's host. With the issuer known, that reasoning no longer holds.
There is also no flag for any of this, so an unattended install cannot enable sign-in at all, even though the README says every prompt has one.
The installer offers sign-in through the identity provider, then asks for a client id with no default and no way of finding one. Leaving it blank turns the feature back off, so in practice the answer is always no and the button is never offered.
Endpoints in the NDP realm do not each need their own client: the platform's public client works for any of them, with the realm URL the installer already suggests as the issuer. Answering yes should be enough.
The installer also leaves sign-in off even when a Federation registration carries a client id, on the grounds that the registration names the realm but not the identity provider's host. With the issuer known, that reasoning no longer holds.
There is also no flag for any of this, so an unattended install cannot enable sign-in at all, even though the README says every prompt has one.