<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
Can an access token and id token pair be validated using the id token at_hash after the access token has been refreshed?<o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
In my very limited testing with only one OIDC provider (WSO2), the access token validation method (in spec
<a href="https://openid.net/specs/openid-connect-core-1_0.html#ImplicitTokenValidation">
here</a>) does still work with the access token returned from the refresh endpoint and the id token returned from the token endpoint. I can’t find any mention of this being guaranteed in the specification.
<o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
Also, if this does work, does anyone know how the access token left-most hash can still match the at_hash after access token has been refreshed. I mean, what is the mechanism used to create the refreshed access token to maintain compatibility with id token?<o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
Thank you so much for your time in considering my question!<o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
<o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;font-size:11pt;font-family:Calibri, sans-serif">
Scott<o:p> </o:p></p>
<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<a><b><span style="font-size:10.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59">Scott Dickerson</span></b></a><span style=""><span style="font-size:10.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59"> </span></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><span style="font-size:10.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59">Principal Software Engineer </span></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><span style="font-size:10.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59"><br>
</span></span></p>
<div style="margin:0px 0in 0.000133333px; font-size:11pt; font-family:Calibri,sans-serif">
<img class="EmojiInsert" style="max-width:100%" data-outlook-trace="F:1|T:1" src="cid:2d581e22-aa13-41e8-96df-13741bf600ac"><br>
</div>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59"><br>
</span></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59">Durham office </span></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59">4813 Emperor Blvd., Suite 100 </span></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59">Durham, NC 27703 </span></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><b><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif; color:red"> </span></b></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><b><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59">T</span></b></span><span style=""><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif; color:#0F0F59"> 919.564.2236<br>
<b>E</b> </span></span><span style=""></span><a href="mailto:scott.dickerson@changehealthcare.com"><span style=""><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif; color:#0563C1">scott.dickerson@healthstream.com</span></span><span style=""></span></a><span style=""><span style="font-size:8.0pt; font-family:"Century Gothic",sans-serif"> </span></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><span style=""> </span></span></p>
<p style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span style=""><span style="font-size:7.5pt; color:red">Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review,
use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.</span></span><span style=""><span style="color:#1F497D"> </span></span></p>
<br>
</div>
</div>
</div>
</div>
</body>
</html>