OIDC Issuer discovery from WebID Profile

Search terms you've used

WebID

Impacted environment

In which environment would the proposed feature apply ?

• The browser
• Node.js
• Other (please specify): ...
• I'm not sure.

Feature suggestion

The library should be able to discover OIDC Issuer from WebID Profile this would be used in two places:

1. getWebidFromTokenPayload currently it only seems to verify JWT but not if OIDC Issuer is allowed for that WebID. The client can not rely on the fact that the user actually controls WebID without checking it. It seems that currently, the client can't consider a user to be authenticated as WebID without doing that additional verification.

2. Client could use the discovery feature directly to get a list of valid OIDC Issuers and let users select which one they want to use to authenticate.

Use Cases

In https://github.com/janeirodigital/sai-impl-service/ we want to authenticate users and verify their control over the WebID to create an instance of Authorization Agent associated with that WebID.

The front end also should support user entering their WebID, and if multiple OIDC issuers are discovered, prompt the user to select which one they would like to use.

Start by locating getWebidFromTokenPayload and trace how JWT verification currently handles the WebID. Review the linked Solid OIDC issuer-discovery specification and the browser and Node.js authentication paths. Done means discovering valid OIDC issuers from a WebID Profile and supporting issuer validation and selection for the described use cases.