Flow to confirm WebId Ownership

When a user signs up with an external WebId via the default Email-Password interaction, they should be asked to place a verification triple in their WebId so it is not possible to squat on WebIds.

• Upon sign up, a verification token is generated and saved in the IdP’s database
• A UI is rendered that tells the user how to put their verification token in their WebId and how to put the solid:oidcIssuer predicate in their WebId.
• After pressing submit on that UI the server checks to see if the WebId has both the verification triple and the solid:oidcProvider triple
• If the WebId does not, it returns the same instructions with an error message
• If the WebId does, it creates an account and continues with the login flow as normal.

[matthieubosquet]

I’m glad it helps 😃

It is meant to be the default mechanism.

I’m not too sure what the use case for adding a version of the “enabling IdP protocol” where the IdP relies on another IdP to do so, but without having given it much thought myself, I think you could make a secure one if you wanted to. But you would still need to edit the WebID by adding the new issuer in any case before you can use your newly enabled IdP.

[RubenVerborgh]

Mmm… if you’re registering with an external WebID, you’d expect to have the WebID setup, no?

So the use case we’re trying to cater for here is actually the more generic:

• user has an external RDF document (but no IDP)
• user wants to register for the IDP

OK. fair enough.

I’m not sure what you exactly mean by temporary Solid storage triple? Here too you just add one triple with the verification token/key/string that you can remove once registration is done.

I’m arguing that we don’t need any randomly generated token.

Assuming that https://example.org/people#alice registers for https://alicepod.other.example/, then I suggest Alice adds something like:

<https://example.org/people#alice> pim:storage <https://alicepod.other.example/>.

Why would this need to be a token?

Or why not even solid:oidcIssuer?