Support for Solid-OIDC v0.1.0 (with UMA AS)

Search terms you've used

UMA, as_uri, claim_token

Impacted environment

In which environment would the proposed feature apply ?

• The browser
• Node.js
• Other (please specify): ...

Any environment which the library wants to support: Dyno, Bun etc.

Feature suggestion

Support for https://solidproject.org/TR/oidc (published on 2022-03-28)

Expected functionality/enhancement

Client should use DPoP bound ID token and push it as a claim to UMA AS.
Access tokens shouldn't cross security domains and only be used with RS which advertised the AS with as_uri

Actual functionality/enhancement

• specification
• primer

Use Cases

There is an open source Keycloack extension coming which conforms to the published Solid-OIDC draft
https://github.com/CarrettiPro/keycloak-solid

Preferably this client should be able to work with it.

Start by reading the linked Solid-OIDC specification and primer, focusing on DPoP-bound ID tokens, UMA claim tokens, and the as_uri requirement. Review the client authentication flows before defining the change; done means supporting the specified browser and Node.js behavior without sending access tokens across security domains, including compatibility with the referenced Keycloak extension.