Call for review: the Solid OIDC spec

[csarven]

As I understand WICG's WebID, it shares some goals with RWW/Solid's WebID (identity) and Solid OIDC (authentication). Please bear in mind #41 so to not conflate different uses of "WebID".

---

Call for review: the Solid OIDC spec (ED) https://solid.github.io/authentication-panel/solid-oidc/ by the Solid Community Group: https://www.w3.org/community/solid/

From your perspective, what's the delta/overlap between WICG's WebID and Solid's WebID + OIDC? Which aspects of Solid OIDC can potentially be native to the browser (re this repo)?

Would a meeting between the two CGs help?

[samuelgoto]

Thanks for kicking this off!

Would a meeting between the two CGs help?

I think this would be the most constructive next step: to introduce ourselves and to informe ourselves better. We could read each other's docs, but I bet that a 1-2 hour VC call would go a long way.

WDYT?

[csarven]

Great, let's do it! The SolidCG has an authentication-panel with weekly meetings on Mondays at 15:00 UTC: https://github.com/solid/authentication-panel . We can reuse that slot (or go with something else) and add another hour or so. Let me know what works for you/WICG. We are on Gitter.. you can also ping me (csarven) on irc.w3.org. We'll make sure to review your notes beforehand to get more out of the meeting time.

[csarven]

Looks like Feb 22 at 17:00 GMT works for most. We can use https://meet.jit.si/solid-wicg-identity-authentication . Will update this comment if anything changes.

[timcappalli]

The WebID referenced in the Solid OIDC proposal is a very old proposal in W3C from 2014 is not the same WebID that is being proposed in this repo in WICG.

Are you aware of this @csarven @samuelgoto ?

[csarven]

Thank you all. That was great!

Side chat from the meeting: https://github.com/solid/authentication-panel/blob/master/meetings/2021-02-22-webid.md (redacted some information).

[samuelgoto]

Thanks you all, this has been extremely useful to us and we are looking forward (a) learn more about solid, (b) learn more about what API surface / affordances solid needs from browsers, (c) gather feedback/recommendations for the direction my group is taking and (d) find opportunities to work on things that are intrinsically of common interest.

[samuelgoto]

On the naming collision, wanted to re-iterate what I said on the call that we are entirely uncommitted to WebID as a brand/name and have no reasons to litigate for it (that I'm personally aware of). Changing names hasn't been a major priority for us because we have had bigger fish to fry, but we can course correct if that's urgent for you all.

Details here:

#41 (comment)

Very unfortunate name collision, which we were planning to address once we know more what shape this takes.
For context, WebID's name inspiration/context come a lot more from OpenID ("OpenID built on the Web") and BrowserID (Mozilla Personas) than the WebID you are pointing to (which we only became aware much later in the process).

We have three or four different alternatives that this could take, so it is very premature for us to pick any final name before knowing what the API does (i.e. WebID has been a project codename so far).

[samuelgoto]

Much of the discussion on "should this be in Credential Manager?" goes along the lines of this point too:

We have three or four different alternatives that this could take, so it is very premature for us to pick any final name before knowing what the API does (i.e. WebID has been a project codename so far).

With the overall answer "it is too early to know and we are uncommitted either way" (e.g. we are exploring options for API affordances that are in HTML or in HTTP and it is too soon to know which one is going to work).

[csarven]

IMO: Changing names is not urgent and thanks for willing follow up. Please go ahead and do it at your own pace. If it helps to send the right signal to both communities as well as others, updating the README in this repo might help for the time being.

[bblfish]

Thanks for the great conversation. I am happy to help future proof ideas that come up here.
The picture of Solid I showed appears in the HttpSig authentication proposal. I explain there what the Solid use case is. It is a good one to test ideas as it is very much a peer to peer protocol in the original sense of the word. Some things that are very different to current practice is that Authentication can be resource based - as each resource can have different access control rules. Hence the need for policies to allow the authentication agent to make decisions on which Credential to use for 80% of the cases without asking the user directly each time. It also means that protocols enhancements such as P2P Extension to HTTP could make a big difference, and even more so if this were integrated with HTTP/3.
For history there is a short video of a talk I gave in 2011 for the Mozilla Workshop on Identity in the Browser at WebID.info, where I describe some of the problems with TLS Client authentication. I did not get to the problem of clients being overwhelmed with client certificate pop ups)

[bblfish]

Also we do have a discussion on Solid on integration with DID, and I commented on how similar WebIDs are to DIDs. (Which they should be). I need to refine that picture.

[samuelgoto]

IMO: Changing names is not urgent and thanks for willing follow up. Please go ahead and do it at your own pace. If it helps to send the right signal to both communities as well as others, updating the README in this repo might help for the time being.

Done.

Pushed to my personal fork will send a PR to be reviewed and merged with the official one soon.

[samuelgoto]

IMO: Changing names is not urgent and thanks for willing follow up. Please go ahead and do it at your own pace. If it helps to send the right signal to both communities as well as others, updating the README in this repo might help for the time being.

Merged.

not to be confused with this WebID whose authors have graciously allowed us to use this as a codename until we find a better one

Feel free to LMK if you find this insuficcient.

[csarven]

@samuelgoto That works! And thanks again for the update.

[samuelgoto]

@samuelgoto That works! And thanks again for the update.

Neat, glad to hear!

I think I forgot to mark this as fixed, so doing that now. Feel free to reopen if you feel like I missed something to resolve this.