<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I ran into something when doing interop testing between MITREid Connect and Roland’s test framework: how is the server supposed to decide *when* to sign or encrypt the response from the UserInfo Endpoint as a JWT instead of a JSON object? We had requests from clients who want to be able to switch based on the Accept header, and so that’s how we originally implemented the decision logic. However, when doing interop testing with Roland, we found that his test client sent no Accept header at all, which confused our naive content negotiation. Even though we’ve now fixed that specific issue (made the header optional on the scanner, FWIW), I’m still scratching my head on this one:<div><div><br></div><div>The specs give clients a mechanism for determining which algorithm to use via userinfo_signed_response_alg and the like, but should a client be able to request a JSON object through a request “Accept” header instead (which is much more HTTP-ish)? In which case, could a client with no registered userinfo_signed_response_alg ask for a signed object through an “Accept” header and take whatever signing mechanism the server deems reasonable as a default, just like what happens with the ID Token? </div><div><br></div><div><br></div><div>The way I’m leaning is logic basically like the following:</div><div><br></div><div><br></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div>if (client has preferred sign/encrypt algorithm):</div></div><div><div> if (request is for JSON):</div></div><div><div> return JSON</div></div><div><div> else:</div></div><div><div> return JWT with client preference</div></div><div><div>else:</div></div><div><div> if (request is for JWT):</div></div><div><div> return JWT with server default</div></div><div><div> else:</div></div><div><div> return JSON</div></div></blockquote><div><div><br></div><div><br></div><div>What have other implementations done here? Do you use HTTP content negotiation at all or just go with the registered field?</div><div><br></div><div> — Justin</div></div></body></html>