Use solid pod as back-end login

Become a Pod Provider Backend Development
5

I have done some further research and it seems, that I have found a solution. Solid uses an asymmetric key pair to sign and validate the JWT. The token gets signed with a private key, but it could be verified with a public key. The public keys are also known as JSON Web Key Set and could be simply retrieved by an API endpoint: “https://…solid-server-domain…/jwks”.

Thus the following workflow should be possible:
Precondition: The Client is not logged in.
Workflow:

  1. Client enters my website.
  2. Client logs into the solid provider according the webid oidc workflow
  3. After successful authentication the client sents a request which needs authentication to my back-end. Its previously acquired token is placed in the http header and passed along with the request.
  4. My back-end server determines the the URL of the solid provider which has issued the token by the iss-claim of the token.
  5. The server request the public key to verify the token and keeps it in its local cache.
  6. The server verifies the token withe the public key and sent a response.

This is still a theoretic solution. If I have got a running example, I will let you know.