The reference implementation of the Nuts specification. A decentralized identity network based on the w3c ssi concepts with practical functionality for the healthcare domain.
There should be a way to derive the subject ID from a DID: when a remote party accesses data using a service-to-service access token, the PEP extracts the DID of the local party, which is then passed to the upstream resource server.
But the vendor applications now interact with the Nuts node using the subject ID instead of DID, so applications administer subject ID of DID (e.g. in mapping to a tenant/customer-specific FHIR store). Thus; it needs to know which subject the token is about, instead of just the DID. Options:
Have an API that returns the subject ID for a particular DID (and all related DIDs and other useful info)
Have Token Introspection provide the subject as issuer
There should be a way to derive the subject ID from a DID: when a remote party accesses data using a service-to-service access token, the PEP extracts the DID of the local party, which is then passed to the upstream resource server.
But the vendor applications now interact with the Nuts node using the subject ID instead of DID, so applications administer subject ID of DID (e.g. in mapping to a tenant/customer-specific FHIR store). Thus; it needs to know which subject the token is about, instead of just the DID. Options:
2nd is probably the most correct.