"scopes_supported": ["webid"]

[michielbdejong]

According to https://solid.github.io/solid-oidc/#discovery the JSON on /.well-known/openid-configuration must include at least
"scopes_supported": ["webid"] and if you combine https://solid.github.io/solid-oidc/#tokens-access with https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata you can conclude that
"claims_supported": ["webid"] is also at least recommended.
The new solid-oidc-tests test for this, and so NSS instances will fail both these tests.
See also https://gitter.im/solid/test-suite?at=6193afa5a41fd20699464377

[bourgeoa]

@michielbdejong should this be closed following solid/solid-oidc#56

[michielbdejong]

No, that issue was just about whether the current text of the solid-oidc spec is clear enough. The need/desirability for adding them in all Solid-oidc servers is undisputed, that stems from the 'recommended' mention in the parent oidc spec.

So NSS should announce both scopes_supported and claims_supported.

[bourgeoa]

I do not follow recommended is not a MUST but a MAY.

[TallTed]

In point of fact, RECOMMENDED is neither a MUST nor a MAY, but a SHOULD.

Quoted from RFC 2119:

3. SHOULD   This word, or the adjective "RECOMMENDED", mean that there
   may exist valid reasons in particular circumstances to ignore a
   particular item, but the full implications must be understood and
   carefully weighed before choosing a different course.

[bourgeoa]

@acoburn
Could you clarify this point.

It has got some importance due to a need to add scopes_supported: ["openid", "offline_access"] to be able to use latest https://github.com/inrupt/solid-client-authn see issue inrupt/solid-client-authn-js#1991 and solution provided by inrupt https://gitter.im/solid/solidos?at=621cca8d6b912423200f5e4f

What should be implemented with the intention to follow solid-oidc spec and not to break NSS using inrupt auth module.

[bourgeoa]

see nodeSolidServer/oidc-op#35