An authentication system determines the identity of a user or agent and the level of trust associated with this identity.
For authentication, the ESS OpenID Provider implements the Solid-OIDC specification. Solid-OIDC specification builds upon the OpenID Connect standards, which itself builds on the OAuth 2.0 authorization framework.
OAuth 2.0 defines a framework for authorization, in which a client obtains an access token to obtain access to resources.
OpenID Connect defines a standard mechanism by which a web application leads a user through a login flow. The login flow results in a signed ID token, which is a JSON Web Token (JWT) that asserts the identity of the user.
Since OpenID Connect builds on the OAuth 2.0 framework, OpenID Connect flow produces both access tokens and ID tokens. As the token names suggest, access tokens are generally used to gain access to resources whereas ID tokens are used to identify a user.
Rather than representing the identity of users
with any string (e.g.,
user1234, etc.), Solid
identifies users with a WebID. A WebID is a URL (e.g.,
https://id.<ESS Domain>.com/user1234) that can be
dereferenced to an RDF profile document.
ESS includes a WebID Service. WebIDs issued by ESS have the form:
Per the 2021 Solid-OIDC specification changes, ESS 2.0 only supports JSON-LD Client Identifier documents. ESS 2.0 no longer supports Client Identifier as a JSON literal in an RDF file.
For more information, see Solid-OIDC specification: Client Identifiers.
The ESS login flow, which implements the Solid-OIDC specification, returns ID tokens and access tokens.
An ID token asserts the identity of the user and is represented as a JSON Web Token (JWT).
ID Token Structure#
ESS ID tokens have a default lifespan of 5 minutes (see
Signed Access Token#
The ESS login flow results in signed access tokens. Access tokens provide access to resources. An access token issued by ESS is represented as a JSON Web Token.
ESS verifies the token signature and that the token has not expired. An invalid token cannot be used to gain access to resources.
Signed Access Token Structure#
ESS uses the JWT-based structure for access tokens.
ESS access tokens have a default lifespan of 5 minutes (see
Demonstration of Proof-of-Possession (DPoP) Token#
As an additional layer of protection against token stealing and various replay attacks, Solid clients can send an additional HTTP header (specifically a DPoP proof).
A DPoP proof can be used to verify that a client is in legitimate possession of an access token while also scoping the request to a particular Pod resource. This helps prevent against token exfiltration attacks.