[Openid-specs-ab] Issue #904: Core Section 3 (openid/connect)

John Bradley issues-reply at bitbucket.org
Mon Nov 25 23:06:28 UTC 2013

New issue 904: Core Section 3

John Bradley:

For Core Section 3 I would like to add the following optional parameter to the login initiation endpoint.

OPTIONAL. If the initiator is the iss then it may include an initial id_token.  The value of exp SHOULD be set to a small value in the range of 5 minutes. 
The id_token must contain a valid aud restricting it to the client receiving it.
If the client receives a value for this string-valued parameter, it MUST include it in the subsequent authorization request as the id_token_hint parameter value.

I have been getting push back from people looking to convert from SAML that Connect forces many more round trips than SAML for doing IdP initiated login.  
Sending an initial short lived id_token lets the client do the quick customization of the UI that the id_token was intended to enable while allowing the client to get access tokens and a new id_token in the background using prompt=none.  

This also reduces the eventual pressure to add more parameters to the endpoint as the AS can tack on additional claims it needs to maintain state.

I think we did have the id_token as a parameter at wine point then changed it to the login_hint when that was added to make it more general.

I know this is a late addition request.

More information about the Openid-specs-ab mailing list