> For the complete documentation index, see [llms.txt](https://docs.inrupt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inrupt.com/ess/services/advanced-configuration.md).

# Advanced Configuration

Enterprises with existing identity providers exchange tokens with the Platform Management service to enable identity integration. No other services are required for standard deployments.

In cases where ESS needs to interoperate with other Solid servers or issue Solid-OIDC-compliant tokens, Inrupt provides additional ESS services to enable this.

## Solid Interoperability Services

In addition to the [core ESS services](/ess/services.md), the following ESS services enable Solid interoperability:

| Service                                                                   | Purpose                                                                 |
| ------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| [Solid OIDC Broker](/ess/services/advanced-configuration/service-oidc.md) | Issues Solid-OIDC tokens for interoperability with other Solid servers  |
| [WebID Service](/ess/services/advanced-configuration/service-webid.md)    | Hosts and manages WebID Profile Documents                               |
| [Start Service](/ess/services/advanced-configuration/service-start.md)    | Provides a user-facing application for sign-up, login, and provisioning |

## Authentication Flow

All ESS deployments require an Identity Provider compatible with OpenID Connect. The Solid OIDC Broker is itself an Identity Provider — tokens it issues go through the same token exchange flow as any other IdP:

```
Client → Identity Provider → Platform Management (token exchange) → ESS Access Token
```

In a standard deployment, the Identity Provider is your enterprise IdP. A client authenticates with it and exchanges the resulting token for an ESS Access Token.

When the Broker is deployed, it takes that position: the Broker is the Identity Provider that ESS trusts, and it in turn brokers authentication to your enterprise IdP. The tokens it issues are Solid-OIDC tokens, exchanged for ESS Access Tokens in the same way, and they are also recognized by other Solid servers — so an agent that signs in through the Broker can access resources shared to it elsewhere in the Solid ecosystem, using the agent's WebID (hosted by the WebID Service) for identity.

## Configuration

### Platform Management

Configure your trusted IdPs for token exchange, as in a standard deployment. Because the Broker is an Identity Provider in its own right, configure the Platform Management service to trust **the Broker's** issuer URL rather than that of the external IdP it brokers. See [Trusted Identity Provider Configuration](/ess/services/service-platform-management/token-exchange.md#trusted-identity-provider-configuration).

### Solid OIDC Broker

The Broker must be registered as a client with your Identity Provider. See [Solid OIDC Broker Service](/ess/services/advanced-configuration/service-oidc.md) for configuration details.

### WebID Service

The WebID Service uses ESS Access Tokens for authentication — it trusts the Platform Management service directly and does not require its own issuer allow list. Configuration:

* [**`INRUPT_WEBID_ISSUER`**](/ess/services/advanced-configuration/service-webid.md#inrupt_webid_issuer) — Required issuer(s) for the `solid:oidcIssuer` triple in WebID Profile Documents
* [**`INRUPT_WEBID_ALLOWED_CLIENT_IDS`**](/ess/services/advanced-configuration/service-webid.md#inrupt_webid_allowed_client_ids) — Clients authorized to modify WebID profiles

### Start Service

The Start Service must be configured with the Platform Management service URL and registered as an allowed client:

* [**`INRUPT_PLATFORM_HTTP_BASE_URL`**](/ess/services/advanced-configuration/service-start.md#inrupt_platform_http_base_url) — Platform Management service URL
* [**`INRUPT_START_CLIENT_ID`**](/ess/services/advanced-configuration/service-webid.md#inrupt_start_client_id) — Start application Client ID (set on the WebID Service)