<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>For Core Section 3 I would like to add the following optional parameter to the login initiation endpoint.</div><div><br></div><dt style="margin-top: 0.5em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">id_token</dt><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">OPTIONAL. If the initiator is the iss then it may include an initial id_token. The value of exp SHOULD be set to a small value in the range of 5 minutes. </dd><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">The id_token must contain a valid aud restricting it to the client receiving it.</dd><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">If the client receives a value for this string-valued parameter, it MUST include it in the subsequent authorization request as the id_token<samp>_hint</samp> parameter value.</dd><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;"><div><br></div></dd><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;"><br></dd><div>I have been getting push back from people looking to convert from SAML that Connect forces many more round trips than SAML for doing IdP initiated login. </div><div>Sending an initial short lived id_token lets the client do the quick customization of the UI that the id_token was intended to enable while allowing the client to get access tokens and a new id_token in the background using prompt=none. </div><div><br></div><div>This also reduces the eventual pressure to add more parameters to the endpoint as the AS can tack on additional claims it needs to maintain state.</div><div><br></div><div>I think we did have the id_token as a parameter at wine point then changed it to the login_hint when that was added to make it more general.</div><div><br></div><div>I know this is a late addition request.</div><div><br></div><div>John B.</div></body></html>