Align NSS with LWS 1.0 Authentication Suite

Context

The W3C Linked Web Storage WG published four First Public Working Drafts of the LWS 1.0 Authentication Suite on 2026-04-23:

• LWS 1.0 Authentication Suite: OpenID Connect
• LWS 1.0 Authentication Suite: SAML 2.0
• LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers
• LWS 1.0 Authentication Suite: Self-signed Identity using did:key

Trust resolution across these specs relies on Controlled Identifiers v1.0 — verifiers dereference the subject URI and inspect a service[] / verificationMethod[] document.

Goal

Align NSS's WebID profile emission and auth verifiers with the LWS 1.0 suite. The intent is additive / dual-write so existing Solid clients keep working against NSS pods — the CID fields layer on top of the existing WebID predicates rather than replacing them.

Checklist

• Profile emission — CID service[] (mirror solid:oidcIssuer, pim:storage, ldp:inbox as typed services). Cheapest first step.
• LWS10 OpenID Connect verifier
• did:key authentication
• CID self-signed authentication
• SAML 2.0 — deferred unless a concrete deployment asks

Cross-repo coordination

JavaScript Solid Server is tracking the same work:

• JSS #319 — umbrella
• JSS #320 — CID service[] profile dual-write (same phrasing worth reusing here)
• JSS #86 — did:key implementation notes

Consistency in vocabulary and profile shape across NSS + JSS (+ CSS eventually) would let the same LWS-aware clients read pods on any server.

Start with the profile emission and authentication verifier entry points in NSS, then read the linked LWS 1.0 Authentication Suite and Controlled Identifiers specifications. Compare the proposed dual-write shape with JSS issues #319 and #320. Done means existing WebID predicates remain available while the requested CID services and selected LWS-aware verifiers are supported.