Repository navigation
Allow the WebID and OIDC providers to reside on different domains #521
Description
Activity
Searching for 'OpenID Connect delegation', I've found this StackOverflow answer https://stackoverflow.com/a/28022632 which links to http://openid.net/specs/openid-connect-discovery-1_0.html#URLSyntax
Would something like below work?
https://ruben.verborgh.org/profile/#me http://openid.net/specs/connect/1.0/issuer https://drive.verborgh.org/ .great find, @elf-pavlik , re
http://openid.net/specs/connect/1.0/issuerrel!@elf-pavlik After some discussion with @timbl, we decided not to go with
http://openid.net/specs/connect/1.0/issuer, usesolid:oidcIssuerinstead:<https://ruben.verborgh.org/profile/#me> <http://www.w3.org/ns/solid/terms#oidcIssuer> <https://drive.verborgh.org> .
I suppose we can add some sort of rdfs/owl equivalence to the specs issuer link, but I'm not familiar enough with ontologies to do that. Feel free to make an addition to solid/vocab#23, though.
Depends on the semantics. Are they equivalent? Or is
solid:oidcIssuersomething more specific?You're right, I suppose
solid:oidcIssueris more specific; it denotes that the server supports the WebID-OIDC protocol specifically.Done: solid/vocab@c70a6c4
Reacted by Diego Pino NavarroNice!
Fixed by #545.
Should be addressed by PR #553
Implemented in PR #553, closing.
Right now, OIDC providers can only authenticate users on their own domain.
However, the WebID resource could explicitly indicated trusted OIDC domains or providers. For example, then I'd be able to authenticate as https://ruben.verborgh.org/profile/#me from https://drive.verborgh.org/ with OIDC. (Right now, I can only do that via WebID+TLS.)