Question:<div><br></div><div>In section 3.2.1 (Introspection Request), id_token is listed as required. In section 3.2.2 (Introspection Response), there is an example shown where the request is: </div><div><meta charset="utf-8"><span class="Apple-style-span" style="font-family: verdana, charcoal, helvetica, arial, sans-serif; "><pre style="font-family: 'Courier New', Courier, monospace; font-size: small; text-align: left; padding-top: 4px; padding-right: 4px; padding-bottom: 4px; padding-left: 4px; color: rgb(0, 0, 0); background-color: rgb(204, 204, 204); ">
GET /id_token?access_token=eyJ0eXAiOiJKV1QiL HTTP/1.1
Host: <a href="http://server.example.com">server.example.com</a></pre></span></div><div>If id_token is required, shouldn't it be shown in the request rather than (or maybe in addition to?) the access_token?</div><div>
<br></div><div><br><br><div class="gmail_quote">On Fri, Jul 29, 2011 at 9:56 PM, Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">Thanks to much heavy lifting by Nat and John, we now have a first draft of the OpenID Connect Lite spec ready for you to review. The goal is that developers should be able to implement a minimal OpenID Connect implementation using only
the information contained in this specification. (They’ll also have to implement Discovery and Registration if they want to enable interactions between parties that are not pre-configured to know about one another.) Please give it a read!<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">OpenID Connect Lite: <a href="http://openid.net/specs/openid-connect-lite-1_0.html" target="_blank">
http://openid.net/specs/openid-connect-lite-1_0.html</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Major changes relative to the former HTTP Redirect Binding spec are:<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><span lang="EN" style="font-size:10.0pt;font-family:Symbol;color:black"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN" style="font-size:12.0pt;color:black">Removed the
</span><span lang="EN" style="font-size:12.0pt;font-family:"Courier New";color:#003366">code</span><span lang="EN" style="font-size:12.0pt;color:black"> flow. Only the
</span><span lang="EN" style="font-size:12.0pt;font-family:"Courier New";color:#003366">token</span><span lang="EN" style="font-size:12.0pt;color:black"> flow is REQUIRED in Lite.
<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><span lang="EN" style="font-size:10.0pt;font-family:Symbol;color:black"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN" style="font-size:12.0pt;color:black">Make requesting the
</span><span lang="EN" style="font-size:12.0pt;font-family:"Courier New";color:#003366">id_token</span><span lang="EN" style="font-size:12.0pt;color:black"> be REQUIRED. The
</span><span lang="EN" style="font-size:12.0pt;font-family:"Courier New";color:#003366">id_token</span><span lang="EN" style="font-size:12.0pt;color:black"> is treated as opaque.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><span lang="EN" style="font-size:10.0pt;font-family:Symbol;color:black"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN" style="font-size:12.0pt;color:black">Make requesting the
</span><span lang="EN" style="font-size:12.0pt;font-family:"Courier New";color:#003366">token</span><span lang="EN" style="font-size:12.0pt;color:black"> OPTIONAL, depending upon whether an Access Token for the UserInfo endpoint
is needed or not.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><span lang="EN" style="font-size:10.0pt;font-family:Symbol;color:black"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN" style="font-size:12.0pt;color:black">Dropped the
</span><span lang="EN" style="font-size:12.0pt;font-family:"Courier New";color:#003366">schema</span><span lang="EN" style="font-size:12.0pt;color:black"> parameter to the Introspection endpoint, which was formerly a string
with the value </span><span lang="EN" style="font-size:12.0pt;font-family:"Courier New";color:#003366">user_id</span><span lang="EN" style="font-size:12.0pt;color:black">. This is unnecessary since the
</span><span lang="EN" style="font-size:12.0pt;font-family:"Courier New";color:#003366">id_token</span><span lang="EN" style="font-size:12.0pt;color:black"> parameter already can be used to disambiguate the intended uses(s)
of the endpoint.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><span lang="EN" style="font-size:10.0pt;font-family:Symbol;color:black"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN" style="font-size:12.0pt;color:black">Dropped the requested audience from the Lite spec, which was formerly the identifier of the target audience of the response. This could be
part of the Standard spec, but is an advanced scenario, and so not appropriate for Lite.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><span lang="EN" style="font-size:10.0pt;font-family:Symbol;color:black"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN" style="font-size:12.0pt;color:black">Reference the Discovery and Registration specs, since they're needed for interaction between non-pre-configured parties (so that OpenID Connect
installations can be Open).<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in">
<u></u><span lang="EN" style="font-size:10.0pt;font-family:Symbol;color:black"><span>·<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN" style="font-size:12.0pt;color:black">Rearranged sections for readability.<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This replaces the parts of the former HTTP Redirect Binding spec that were mandatory to implement. To complete the refactoring, the Messages spec and Standard spec still need to be produced from parts of the current Core, Framework, and
HTTP Redirect Binding specs. All the specs under the old organization are still also live.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> Thanks all,<u></u><u></u></p>
<p class="MsoNormal"> -- Mike<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><span style="font-family:'Lucida Grande', Tahoma, Arial, Verdana, sans-serif;font-size:10px;color:rgb(42, 42, 42)"><font color="#343634" face="Tahoma" style="color:rgb(52, 54, 52);font-size:12px"><strong><span>Pamela Dingle</span></strong> | <span>Sr. Technical Architect</span></font><br>
<font face="Arial" style="font-size:11px"><font color="#343634" face="Tahoma"><strong>Ping</strong></font><font color="#E71939" face="Tahoma"><strong>Identity</strong></font> | <a href="http://www.pingidentity.com" target="_blank">www.pingidentity.com</a><br>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -<br><font color="#005568"><strong>O:</strong></font> <font color="#343634"><span>303-999-5890</span></font> <font color="#005568"><strong>M:</strong></font> <font color="#343634"><span>303-999-5890</span></font><br>
<font color="#005568"><strong>Email:</strong></font> <span><a href="mailto:pdingle@pingidentity.com" target="_blank">pdingle@pingidentity.com</a></span><br>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -<br>
<table cellpadding="0" cellspacing="0"><tbody><tr valign="top"><td nowrap><div style="float:left"><font face="Arial" style="font-size:11px"><font color="#005568"><strong>Connect with Ping</strong></font><br><font color="#000000">Twitter: @pingidentity</font><br>
<font color="#000000">LinkedIn Group: Ping's Identity Cloud</font> <br><font color="#000000">Facebook.com/pingidentitypage</font></font></div></td><td nowrap><div style="margin-left:20px"><font face="Arial" style="font-size:11px"><font color="#005568"><strong><span>Connect with me</span></strong></font><br>
<font color="#000000"><span>Twitter: @pamelarosiedee</span></font><br><font color="#000000"><span></span></font></font></div></td></tr></tbody></table></font></span><br>
</div>