Advanced Configuration

In a standard deployment, enterprises with existing identity providers exchange tokens with the Platform Management service to enable identity integration. No other services are required.

In cases where ESS needs to interoperate with other Solid servers or issue Solid-OIDC-compliant tokens, Inrupt provides additional ESS services to enable this.

Solid Interoperability Services

In addition to the core ESS services, the following ESS services enable Solid interoperability:

Service	Purpose
Solid OIDC Broker	Issues Solid-OIDC tokens for interoperability with other Solid servers
WebID Service	Hosts and manages WebID Profile Documents
Start Service	Provides a user-facing application for sign-up, login, and provisioning

These three services are deployed together as a unit — the installation manifests do not support deploying one without the others. Adding them also requires two additional databases, taking a deployment from five to seven. See Installation.

Because the Start Service is the only user-facing sign-up and login application, a standard deployment has no self-service onboarding. Identity and Pod provisioning are instead driven by the deploying organization's own application and Identity Provider, using the token exchange and provisioning APIs.

Authentication Flow

All ESS deployments require an Identity Provider compatible with OpenID Connect. The Solid OIDC Broker is itself an Identity Provider — tokens it issues go through the same token exchange flow as any other IdP:

Client → Identity Provider → Platform Management (token exchange) → ESS Access Token

In a standard deployment, the Identity Provider is your enterprise IdP. A client authenticates with it and exchanges the resulting token for an ESS Access Token.

When the Broker is deployed, it takes that position: the Broker is the Identity Provider that ESS trusts, and it in turn brokers authentication to your enterprise IdP. The tokens it issues are Solid-OIDC tokens, exchanged for ESS Access Tokens in the same way, and they are also recognized by other Solid servers — so an agent that signs in through the Broker can access resources shared to it elsewhere in the Solid ecosystem, using the agent's WebID (hosted by the WebID Service) for identity.

Configuration

Platform Management

Configure your trusted IdPs for token exchange, as in a standard deployment. Because the Broker is an Identity Provider in its own right, configure the Platform Management service to trust the Broker's issuer URL rather than that of the external IdP it brokers. See Trusted Identity Provider Configuration.

Solid OIDC Broker

The Broker must be registered as a client with your Identity Provider. See Solid OIDC Broker Service for configuration details.

WebID Service

The WebID Service uses ESS Access Tokens for authentication — it trusts the Platform Management service directly and does not require its own issuer allow list. Configuration:

• INRUPT_WEBID_ISSUER — Required issuer(s) for the solid:oidcIssuer triple in WebID Profile Documents

• INRUPT_WEBID_ALLOWED_CLIENT_IDS — Clients authorized to modify WebID profiles

Start Service

The Start Service must be configured with the Platform Management service URL and registered as an allowed client:

• INRUPT_PLATFORM_HTTP_BASE_URL — Platform Management service URL

• INRUPT_START_CLIENT_ID — Start application Client ID (set on the WebID Service)