feature: support both WebID-TLS and Solid-OIDC authentication simultaneously

Open
#1,844 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
javascript, node.js
Domain
authentication, backend

Research direction

Start in lib/create-app.mjs:335-339, then inspect the API.authn.oidc and API.authn.tls initialization entry points. Verify how each handler calls next() when credentials are absent and define completion as both WebID-TLS and Solid-OIDC clients authenticating against the same server.

Written by the indexing model from the issue text.

Description

Summary

Currently NSS only supports one authentication method at a time (--auth tls OR --auth oidc). It would be valuable to support both simultaneously.

Current Behavior

// lib/create-app.mjs:335-339
const auth = argv.forceUser ? 'forceUser' : argv.auth
if (!(auth in API.authn)) {
  throw new Error(`Unsupported authentication scheme: ${auth}`)
}
await API.authn[auth].initialize(app, argv)  // Only ONE method initialized

Proposed Behavior

Initialize both auth handlers and let them chain naturally:

async function initAuthentication(app, argv) {
  // Initialize both handlers
  await API.authn.oidc.initialize(app, argv)
  await API.authn.tls.initialize(app, argv)
}

The handlers already call next() when they don't find their credentials, so they'd naturally fall through to the next method.

Benefits

  1. Flexibility - Different clients can use different auth methods against the same server
  2. Migration path - Users can transition gradually between auth methods
  3. Spec compliance - Solid doesn't mandate one auth method over another
  4. Client compatibility - Legacy TLS clients and modern OIDC clients work together

Implementation

The change is minimal:

  • Remove the either/or logic in initAuthentication()
  • Initialize both handlers (or make it configurable: --auth oidc,tls)
  • Auth chain: OIDC → TLS → anonymous

Prior Art

JavaScriptSolidServer (JSS) already supports this - it tries auth methods in sequence:

  1. Solid-OIDC (DPoP tokens)
  2. WebID-TLS (client certificates)
  3. Bearer tokens

Works well and provides maximum flexibility.

Dominant language
JavaScript
Stars
1.8k
Forks
308
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nodeSolidServer/node-solid-server

All issues in nodeSolidServer/node-solid-server

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.