From 7ced60a3e8de4e5bac47431929a63cfdd5b61ca5 Mon Sep 17 00:00:00 2001
From: Aaron Coburn <aaronc@inrupt.com>
Date: Wed, 12 Aug 2026 14:38:55 -0500
Subject: [PATCH] Add subject_uri_schemes_supported property to Authorization
 Server metadata requirements

---
 lws10-core/Authorization.html       | 27 +++++++++++++++++++++++----
 lws10-core/IANA-Considerations.html | 15 +++++++++++++++
 2 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/lws10-core/Authorization.html b/lws10-core/Authorization.html
index 287ed7b..124b445 100644
--- a/lws10-core/Authorization.html
+++ b/lws10-core/Authorization.html
@@ -87,11 +87,26 @@ <h4>Authorization Server Metadata</h4>
     </p>
 
     <p>
-      An authorization server SHOULD advertise the subject tokens that it supports by including a <code>subject_token_types_supported</code>
-      entry in the server metadata document. This entry is a JSON array containing a list of valid <code>subject_token_type</code> values
-      that can be supplied at the authorization server's token endpoint.
+      In addition to the metadata defined in [[!RFC8414]], an LWS authorization server metadata document
+      defines the following parameters:
     </p>
 
+    <ul>
+      <li>
+        <code>subject_token_types_supported</code>
+        OPTIONAL. JSON array containing a list of valid <code>subject_token_type</code> values
+        that can be supplied at the authorization server's token endpoint. An authorization server
+        SHOULD advertise the subject tokens that it supports by including this entry in the server metadata document.
+      </li>
+      <li>
+        <code>subject_uri_schemes_supported</code>
+        OPTIONAL. JSON array containing a list of URI scheme values for subject identifiers that the
+        authorization server supports. An authorization server SHOULD advertise the subject URI schemes
+        that it supports by including this entry in the server metadata document.
+        If omitted, the default value is <code>["https"]</code>.
+      </li>
+    </ul>
+
     <p>
       An example authorization server metadata resource is included below.
     </p>
@@ -112,7 +127,11 @@ <h4>Authorization Server Metadata</h4>
         "token"],
     "subject_token_types_supported": [
         "urn:ietf:params:oauth:token-type:jwt",
-        "urn:ietf:params:oauth:token-type:id-token"]
+        "urn:ietf:params:oauth:token-type:id-token"],
+    "subject_uri_schemes_supported": [
+        "did:web",
+        "did:key",
+        "https"]
 }
     </pre>
 
diff --git a/lws10-core/IANA-Considerations.html b/lws10-core/IANA-Considerations.html
index 5505bc9..ab6a5d7 100644
--- a/lws10-core/IANA-Considerations.html
+++ b/lws10-core/IANA-Considerations.html
@@ -42,6 +42,21 @@ <h3>OAuth Authorization Server Metadata Registry</h3>
       Specification Document(s): Section 5 of LWS-Auth
     </li>
   </ul>
+
+  <ul>
+    <li>
+      Metadata Name: subject_uri_schemes_supported
+    </li>
+    <li>
+      Metadata Description: JSON array containing a list of URI scheme values for subject identifiers that this authorization server supports
+    </li>
+    <li>
+      Change Controller: W3C
+    </li>
+    <li>
+      Specification Document(s): Section 5 of LWS-Auth
+    </li>
+  </ul>
 </section>
 
 <section id="iana-media-type-registry">