Subject should be provided to Resource Server by PEP

[reinkrul]

There should be a way to derive the subject ID from a DID: when a remote party accesses data using a service-to-service access token, the PEP extracts the DID of the local party, which is then passed to the upstream resource server.

But the vendor applications now interact with the Nuts node using the subject ID instead of DID, so applications administer subject ID of DID (e.g. in mapping to a tenant/customer-specific FHIR store). Thus; it needs to know which subject the token is about, instead of just the DID. Options:

• Have an API that returns the subject ID for a particular DID (and all related DIDs and other useful info)
• Have Token Introspection provide the subject as issuer

2nd is probably the most correct.

[woutslakhorst]

might become client_id (from authorization server metadata) and thus will be available?

[woutslakhorst]

~~fixed ~~