Align NSS with LWS 1.0 Authentication Suite

Context

The W3C Linked Web Storage WG published four First Public Working Drafts of the LWS 1.0 Authentication Suite on 2026-04-23:

• LWS 1.0 Authentication Suite: OpenID Connect
• LWS 1.0 Authentication Suite: SAML 2.0
• LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers
• LWS 1.0 Authentication Suite: Self-signed Identity using did:key

Trust resolution across these specs relies on Controlled Identifiers v1.0 — verifiers dereference the subject URI and inspect a service[] / verificationMethod[] document.

Goal

Align NSS's WebID profile emission and auth verifiers with the LWS 1.0 suite. The intent is additive / dual-write so existing Solid clients keep working against NSS pods — the CID fields layer on top of the existing WebID predicates rather than replacing them.

Checklist

• Profile emission — CID service[] (mirror solid:oidcIssuer, pim:storage, ldp:inbox as typed services). Cheapest first step.
• LWS10 OpenID Connect verifier
• did:key authentication
• CID self-signed authentication
• SAML 2.0 — deferred unless a concrete deployment asks

Cross-repo coordination

JavaScript Solid Server is tracking the same work:

• JSS #319 — umbrella
• JSS #320 — CID service[] profile dual-write (same phrasing worth reusing here)
• JSS #86 — did:key implementation notes

Consistency in vocabulary and profile shape across NSS + JSS (+ CSS eventually) would let the same LWS-aware clients read pods on any server.

先從 NSS 中的 profile emission 和 authentication verifier entry points 著手，接著閱讀連結的 LWS 1.0 Authentication Suite 與 Controlled Identifiers 規格。將提議的 dual-write 結構與 JSS issues #319 和 #320 進行比較。當現有的 WebID predicates 仍可使用，同時支援要求的 CID services 與選定的 LWS-aware verifiers 時，即視為完成。