Repository navigation
Allow the WebID and OIDC providers to reside on different domains #521
Description
Right now, OIDC providers can only authenticate users on their own domain.
However, the WebID resource could explicitly indicated trusted OIDC domains or providers. For example, then I'd be able to authenticate as https://ruben.verborgh.org/profile/#me from https://drive.verborgh.org/ with OIDC. (Right now, I can only do that via WebID+TLS.)
Activity
elf-pavlik commentedon Jul 24, 2017
Searching for 'OpenID Connect delegation', I've found this StackOverflow answer https://stackoverflow.com/a/28022632 which links to http://openid.net/specs/openid-connect-discovery-1_0.html#URLSyntax
Would something like below work?
https://ruben.verborgh.org/profile/#me http://openid.net/specs/connect/1.0/issuer https://drive.verborgh.org/ .dmitrizagidulin commentedon Jul 25, 2017
great find, @elf-pavlik , re
http://openid.net/specs/connect/1.0/issuerrel!dmitrizagidulin commentedon Aug 16, 2017
@elf-pavlik After some discussion with @timbl, we decided not to go with
http://openid.net/specs/connect/1.0/issuer, usesolid:oidcIssuerinstead:dmitrizagidulin commentedon Aug 16, 2017
I suppose we can add some sort of rdfs/owl equivalence to the specs issuer link, but I'm not familiar enough with ontologies to do that. Feel free to make an addition to solid/vocab#23, though.
RubenVerborgh commentedon Aug 16, 2017
Depends on the semantics. Are they equivalent? Or is
solid:oidcIssuersomething more specific?dmitrizagidulin commentedon Aug 16, 2017
You're right, I suppose
solid:oidcIssueris more specific; it denotes that the server supports the WebID-OIDC protocol specifically.RubenVerborgh commentedon Aug 16, 2017
Done: solid/vocab@c70a6c4
dmitrizagidulin commentedon Aug 16, 2017
Nice!
RubenVerborgh commentedon Aug 17, 2017
Fixed by #545.
RubenVerborgh commentedon Aug 17, 2017
Ah no, wait, #545 only covers WebID-TLS. This issue requests the same functionality as #545, but with OIDC.
dmitrizagidulin commentedon Aug 18, 2017
Should be addressed by PR #553
dmitrizagidulin commentedon Aug 31, 2017
Implemented in PR #553, closing.