Align NSS with LWS 1.0 Authentication Suite

[melvincarvalho]

Context

The W3C Linked Web Storage WG published four First Public Working Drafts of the LWS 1.0 Authentication Suite on 2026-04-23:

• LWS 1.0 Authentication Suite: OpenID Connect
• LWS 1.0 Authentication Suite: SAML 2.0
• LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers
• LWS 1.0 Authentication Suite: Self-signed Identity using did:key

Trust resolution across these specs relies on Controlled Identifiers v1.0 — verifiers dereference the subject URI and inspect a service[] / verificationMethod[] document.

Goal

Align NSS's WebID profile emission and auth verifiers with the LWS 1.0 suite. The intent is additive / dual-write so existing Solid clients keep working against NSS pods — the CID fields layer on top of the existing WebID predicates rather than replacing them.

Checklist

• Profile emission — CID service[] (mirror solid:oidcIssuer, pim:storage, ldp:inbox as typed services). Cheapest first step.
• LWS10 OpenID Connect verifier
• did:key authentication
• CID self-signed authentication
• SAML 2.0 — deferred unless a concrete deployment asks

Cross-repo coordination

JavaScript Solid Server is tracking the same work:

• JSS #319 — umbrella
• JSS #320 — CID service[] profile dual-write (same phrasing worth reusing here)
• JSS #86 — did:key implementation notes

Consistency in vocabulary and profile shape across NSS + JSS (+ CSS eventually) would let the same LWS-aware clients read pods on any server.