Erfan Gholami
All projects
Android Solid Services app icon

Android Solid Services

The Solid Protocol as a native Android citizen — one sign-in, shared pod access, typed data over IPC. My M.S. thesis, grown into ecosystem infrastructure.

2023 – PresentPolitecnico di Torino · PonderSourceOngoing
Choosing a pod provider, or entering a custom pod server URL
Any Solid provider, or your own server
The signed-in WebID and the storages it advertises
The WebID and the storages it advertises
Two Solid accounts signed in at once, one marked active
Several accounts, all signed in at once
An app's grant, with a button to revoke it
Every grant explicit, every grant revocable
The client sample app with all five IPC services bound, listing its demonstrations
The sample app, running its catalogue against a live pod

Solid is the web's counter-proposal, led by Sir Tim Berners-Lee: your data lives in a pod you own, and apps ask permission — not the other way around. I build Android, and in 2023 that bet had no native path onto the platform that sits in everyone's pocket.

The gap was much bigger than a missing login. An app that wanted a pod had to run the OpenID Connect flow with DPoP token binding, negotiate RDF formats and turn triples into something Kotlin can type, patch and stream resources, and speak two authorization specs before it could share a single file — from scratch, in every app, with every mistake private to each one. So I built the whole path once — as my M.S. thesis at Politecnico di Torino with PonderSource — and then kept building it for three years as NLnet-funded open source.

Today, one app holds the user's pod accounts, and every other app on the device reaches those pods through it — with the user's permission, and without ever touching a credential. For a developer, Solid becomes one dependency and no plumbing at all: implementation("com.erfangholami.androidsolidservices:client:0.7.0").

Where it sits in the ecosystem

The Solid Project's official developer page lists Android Solid Services as the way to build for Android, beside Inrupt's Java SDK. 324 of its 330 commits are mine, v0.7.0 shipped in August 2026, the documentation site opens with a ten-minute quickstart and gives every capability its own page, and Solid Share — my data wallet — runs on top of it.

And it is Solid to the letter: the protocol's resource semantics, Solid-OIDC, Web Access Control, Access Control Policy, Linked Data Notifications and the Type Index, implemented from the specifications rather than around them — so an app built on it speaks the same Solid every pod server speaks, and is tied to none of them.

The whole pod surface

  • The resource layer — typed CRUD over RDF and binary resources, containers browsed like a filesystem, N3 Patch partial updates, ETag-conditioned writes so one device never blindly overwrites another, and streaming transfers that never hold a file in memory
  • The data layer — RDF negotiated, parsed and converted into typed Kotlin models (JSON-LD and N-Quads on the wire), so an app holds data classes, never triples; contacts carry the full vCard 4.0 vocabulary mapped to RDF
  • Sign-in — Solid-OIDC with DPoP token binding (RFC 9449), per-account keys minted in the Android Keystore, tokens encrypted at rest and never crossing the IPC boundary
  • Sharing — plain View / Add / Edit grants over Web Access Control or Access Control Policy, auto-selected per resource, with a Linked Data Notifications inbox for offers and requests
  • Data modules — contacts and tickets as standard RDF with type-index registration, laid out so other Solid apps read the same data without copying it

The pieces

  • The host app — five bound AIDL services that hold the tokens and DPoP keys and proxy every pod request; Solid accounts appear in Android Settings like any other
  • The client library — the IPC SDK: shared sign-in launched from the calling app's own foreground, so nothing needs overlay or other dangerous permissions
  • The api library — the same pod surface for apps that talk to a pod directly, without the host app installed
  • A sample app that runs every SDK call against a live pod, each shown beside the code that made it

Under the hood

  • Four Gradle modules in a layered chain and a self-healing connector that re-binds on binder death — and in 0.7.0 I collapsed twenty-two per-type AIDL callbacks into two carrying a Bundle envelope
  • Documentation treated as part of the product — 23 hand-written pages plus the generated API reference; that site is the one solidproject.org links
  • GitHub Actions publishes all three libraries to Maven Central and a signed APK on every tagged release; versions derive from the git tag, and CI runs Spotless, Detekt, unit tests and an instrumented IPC suite
All projectsWork with meWritten from the repository, not the résumé.