<html><head><base href="about:blank"></head><body style="background-color: transparent; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; " applecontenteditable="true"><base href="about:blank"><div>To summarize, so that I have it strait.</div><div><br></div>So in the main flow you get a access token.<div><br></div><div>You use the access token to get the signed ID token from the get_id_token endpoint.</div><div><br></div><div>For 3 rd parties where they may not have access to the symmetric secret, or particularly lazy clients who don't want to support base64 decoding etc there is a check_id_token endpoint (direct) that returns a unsigned JWT.</div><div><br></div><div>There is a renew_id_token endpoint via redirect.</div><div><br></div><div>You say </div><ul id="internal-source-marker_0.16298126871697605"><li style="list-style-type:disc;font-size:11pt;font-family:Arial;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;text-decoration:none;vertical-align:baseline;"><span style="font-size:11pt;font-family:Arial;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">There’s no UI at this endpoint -- however, immediate mode can be used to suppress login page, which otherwise will be shown when user is not signed-in.</span></li></ul><div></div><div><br><div><br></div><div>Perhaps the immediate mode reference is old? From when we were talking about re-using the authorization endpoint.</div></div><div><br></div><div>In the JWT token we should also include a nonce to prevent replay types of attacks. </div><div><br></div><div>Towards the end you indicate that the id_token may come directly from the token endpoint along with the access token. </div><div><br></div><div><div style="background-color: transparent; font-family: Times; "><span id="internal-source-marker_0.16298126871697605" style="font-size: 11pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; ">Which id_tokens are usable for session synchronization purposes and which are not? To keep things simple for clients, if the client obtains an id_token either by:</span><br><span style="font-size: 11pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "></span><br><span style="font-size: 11pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; ">- Redeeming a code, always obtained via indirect communication through the browser;</span><br><span style="font-size: 11pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; ">- Supplying an access_token to the get_id_token endpoint where the access_token was obtained via indirect communication through the browser;</span></div></div><div style="background-color: transparent; font-family: Times; "><span style="font-size: 11pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "><br></span></div><div style="background-color: transparent; font-family: Times; "><span style="font-size: 11pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; ">I am not against returning the ID_token from athe token endpoint directly, but I thought that you wanted it to be a separate call.</span></div><div style="background-color: transparent; font-family: Times; "><span style="font-size: 11pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "><br></span></div><div style="background-color: transparent; font-family: Times; "><span style="font-size: 11pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; ">John B.</span></div></body></html>