Align NSS with LWS 1.0 Authentication Suite

Context

The W3C Linked Web Storage WG published four First Public Working Drafts of the LWS 1.0 Authentication Suite on 2026-04-23:

• LWS 1.0 Authentication Suite: OpenID Connect
• LWS 1.0 Authentication Suite: SAML 2.0
• LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers
• LWS 1.0 Authentication Suite: Self-signed Identity using did:key

Trust resolution across these specs relies on Controlled Identifiers v1.0 — verifiers dereference the subject URI and inspect a service[] / verificationMethod[] document.

Goal

Align NSS's WebID profile emission and auth verifiers with the LWS 1.0 suite. The intent is additive / dual-write so existing Solid clients keep working against NSS pods — the CID fields layer on top of the existing WebID predicates rather than replacing them.

Checklist

• Profile emission — CID service[] (mirror solid:oidcIssuer, pim:storage, ldp:inbox as typed services). Cheapest first step.
• LWS10 OpenID Connect verifier
• did:key authentication
• CID self-signed authentication
• SAML 2.0 — deferred unless a concrete deployment asks

Cross-repo coordination

JavaScript Solid Server is tracking the same work:

• JSS #319 — umbrella
• JSS #320 — CID service[] profile dual-write (same phrasing worth reusing here)
• JSS #86 — did:key implementation notes

Consistency in vocabulary and profile shape across NSS + JSS (+ CSS eventually) would let the same LWS-aware clients read pods on any server.

先从 NSS 中的 profile emission 和 authentication verifier entry points 入手，然后阅读链接的 LWS 1.0 Authentication Suite 和 Controlled Identifiers 规范。将拟议的 dual-write 结构与 JSS issues #319 和 #320 进行比较。当现有的 WebID predicates 仍然可用，同时支持所请求的 CID services 和选定的 LWS-aware verifiers 时，即视为完成。