Align NSS with LWS 1.0 Authentication Suite

Context

The W3C Linked Web Storage WG published four First Public Working Drafts of the LWS 1.0 Authentication Suite on 2026-04-23:

• LWS 1.0 Authentication Suite: OpenID Connect
• LWS 1.0 Authentication Suite: SAML 2.0
• LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers
• LWS 1.0 Authentication Suite: Self-signed Identity using did:key

Trust resolution across these specs relies on Controlled Identifiers v1.0 — verifiers dereference the subject URI and inspect a service[] / verificationMethod[] document.

Goal

Align NSS's WebID profile emission and auth verifiers with the LWS 1.0 suite. The intent is additive / dual-write so existing Solid clients keep working against NSS pods — the CID fields layer on top of the existing WebID predicates rather than replacing them.

Checklist

• Profile emission — CID service[] (mirror solid:oidcIssuer, pim:storage, ldp:inbox as typed services). Cheapest first step.
• LWS10 OpenID Connect verifier
• did:key authentication
• CID self-signed authentication
• SAML 2.0 — deferred unless a concrete deployment asks

Cross-repo coordination

JavaScript Solid Server is tracking the same work:

• JSS #319 — umbrella
• JSS #320 — CID service[] profile dual-write (same phrasing worth reusing here)
• JSS #86 — did:key implementation notes

Consistency in vocabulary and profile shape across NSS + JSS (+ CSS eventually) would let the same LWS-aware clients read pods on any server.

Commencez par les points d’entrée d’émission de profil et de vérification d’authentification dans NSS, puis lisez les spécifications liées LWS 1.0 Authentication Suite et Controlled Identifiers. Comparez la forme proposée de double écriture avec les issues #319 et #320 de JSS. Le travail est considéré comme terminé lorsque les prédicats WebID existants restent disponibles et que les services CID demandés ainsi que les vérificateurs sélectionnés compatibles avec LWS sont pris en charge.