LWS 1.0 Authentication Suite: OpenID Connect

OpenID Connect is a widely used mechanism for web-based authentication. This authentication suite describes how an OpenID provider can be used with Linked Web Storage-conforming applications.

As well as sections marked as non-normative, all authoring guidelines, diagrams, examples, and notes in this specification are non-normative. Everything else in this specification is normative.

The key words MUST, MUST NOT, and SHOULD in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

The terms "authorization server" and "client" are defined by The OAuth 2.0 Authorization Framework [RFC6749].

The terms "OpenID provider", "id token", "end-user", and "issuer" are defined by OpenID Connect Core 1.0 [OPENID-CONNECT-CORE].

The term "openid connect discovery" is defined by OpenID Connect Discovery 1.0 [OPENID-CONNECT-DISCOVERY].

The term "controlled identifier document" is defined by W3C Controlled Identifiers 1.0 [CID-1.0].

The terms "JSON Web Token (JWT)" and "claim" are defined by JSON Web Token [RFC7519].

The term "JSON Web Key (JWK)" is defined by JSON Web Key [RFC7517].

The terms "authentication credential" and "authentication suite" are defined by Linked Web Storage Protocol [LWS-PROTOCOL]

OpenID Connect defines a protocol for producing signed ID Tokens, which are used to describe an end-user. An ID Token is serialized as a signed JSON Web Token (JWT). In order to use an ID Token as an LWS authentication credential, the following additional requirements apply.

• The ID Token MUST NOT use "none" as the signing algorithm.
• The ID Token MUST use the sub (subject) claim for the LWS subject identifier.
• The ID Token MUST use the iss (issuer) claim for the LWS issuer identifier.
• The ID Token MUST use the azp (authorized party) claim for the LWS client identifier.
• Any audience restriction in the ID Token MUST use the aud (audience) claim. The aud claim SHOULD include the client identifier and any additional target audience such as an authorization server.

An example ID Token that is also an LWS authentication credential is included below.

{
  "typ": "JWT",
  "kid": "12dbe73a",
  "kty": "EC",
  "alg": "ES256",
  "crv": "P-256"
}
.
{
  "sub": "https://id.example/end-user",
  "iss": "https://openid.example",
  "azp": "https://client.example/17da1b",
  "aud": ["https://client.example/17da1b", "https://as.example"],
  "iat": 1761313600,
  "exp": 1761313900
}
.
signature

For an ID Token to validate as an LWS authentication credential, there must be a trust relationship between the verifier and the issuing party.

In the absence of a pre-existing trust relationship, the validator MUST dereference the sub (subject) claim in the authentication credential. The resulting resource MUST be formatted as a valid controlled identifier document [CID-1.0] with an id value equal to the subject identifier.

The verifier MUST use the subject's controlled identifier document to locate a service object whose serviceEndpoint value is equal to the value of the iss claim from the authentication credential, and whose type value is equal to https://www.w3.org/ns/lws#OpenIdProvider. The verifier MUST perform OpenID Connect Discovery to locate the public portion of the JSON Web Key (JWK) used to sign the authentication credential. The JWT MUST be validated as described by OpenID Connect Core Section 3.1.3.7 [OPENID-CONNECT-CORE].

An example Controlled Identifier Document for an agent using OpenID Connect is included below.

{
    "@context": [
        "https://www.w3.org/ns/cid/v1"
    ],
    "id": "https://id.example/end-user",
    "service": [{
        "type": "https://www.w3.org/ns/lws#OpenIdProvider",
        "serviceEndpoint": "https://openid.example"
    }]
}

An ID Token used as an authentication credential MUST use the urn:ietf:params:oauth:token-type:id_token URI when interacting with an authorization server.