<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">On 26. aug.2011, at 20:27, John Bradley wrote:<br><br><blockquote type="cite">An important issue for RP is perceived latency. That is why they don't want to have to do a extra round trip to get the id_token.<br></blockquote><div><br></div><div>That is a very good argument. </div><br><blockquote type="cite">If you have a JS client that needs an access token as well as a id_token it would need to make two separate implicit calls to at the authorization endpoint. <br>I suspect that is the biggest problem. </blockquote><div><br></div><div>In the 'OAuth approach', there is no way of obtaining multiple tokens in the implicit flow; the oauth approach would in this flow issue a multi-scope token to the RP. This could make things much simpler to JS clients. It could be a simpler and smarter way - or it could be a showstopper; anyone with first-hand knowledge to the implicit flow use case that can elaborate a bit on this?</div><div><br></div><div>Note that by issuing a multi-scoped token ( the OAuth way ) in the implicit flow; <b><font class="Apple-style-span" color="#832c27">we solve the issue mentioned earlier about the necessity to include a hash of the access token</font></b> in the id_token. </div><div><br></div><div>Actually in OAuth implicit grant flow, you are NOT allowed to return both an access token and a refresh token; and I suspect that the reasoning behind this is the exact same that we run into with id_token and access token.</div><br><blockquote type="cite"> For a server it is also several round trips that each may require user consent. From a user experience point of view one trip to the OP is enough.<br></blockquote><div><br></div><div>No, there is <b>no additional front-channel</b> round trips in the proposal. Instead some backchannel calls are added to retrieve tokens, and id token + user data.</div><br><blockquote type="cite">We are running into a OAuth issue. There should be a standard way to request multiple tokens. <br></blockquote><div><br></div><div>There is; (you may request multiple scopes in the request) and I'm suggesting that we use it. What there is not, is a way to requset multiple tokens and receive them <b>all at the same time</b>.</div><br><blockquote type="cite">In the case where you only want code in the redirect, scope is about the only place to say that you want a access token for the user-info endpoint and a id_token returned from the token endpoint.<br><br>That was why I was proposing that the openid scope be about the id_token and we define other scopes for user-info.<br></blockquote><div><br></div><div>Great, that is a brilliant idea :) And this is also what I am suggesting :)</div><br><blockquote type="cite">That way scope controls what tokens you want (perhaps others for portable contacts etc), and response_type controls how you get them.<br></blockquote><div><br></div><div>Exactly.</div><br><blockquote type="cite">There was a proposal to the allow multiple access tokens to be returned by making it an array or structure. <br>That didn't happen, so we are on our own to define how multiple tokens are returned.<br></blockquote><div><br></div><div>If we need them returned all at once.</div><br><blockquote type="cite">That makes it more complicated to use standard libraries. I don't think we are the only ones with this issue<br><br>The other issue with treating a id_token as an access token is that some frameworks don't make it easy to get at the contents of the token used to authenticate to the endpoint. <br>I suspect that is going to be a problem with them using any sort of JWT as an access token.<br></blockquote><br><div>Yup. The response of the token endpoint is most likely handled all by the OAuth client library, and it should follow the OAuth spec section 4.2.2:</div><div><br></div><div><i><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-style-span" style="font-family: BitstreamVeraSans; font-size: 13px; ">The client SHOULD ignore unrecognized response parameters.</span></i></div>
<span style="font-size: 10.000000pt; font-family: 'BitstreamVeraSans'"> <br></span><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">And I assume there it is a significant probability that these unrecognized response parameters are accessilble through the client library API.</span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;"><br></span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">This also is pointing in the direction of beeing more streamlined with OAuth.</span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;"><br></span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">Some arguments pro this approach:</span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">* Simpler spec, easier to understand.</span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;"><span class="Apple-tab-span" style="white-space:pre"> </span></span></font><span class="Apple-style-span" style="font-family: BitstreamVeraSans; font-size: 13px; ">No confusion of what is a token, and is a 'token' to be decoded or used as if it were an access token…</span></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">* Simpler to implement, more re-use of OAuth library. </span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;"><br></span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">Some arguments against this approach:</span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">* Additonal back-channel calls to resolve tokens, and tokens to JWT.</span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">* Potentially a showstopper with a multi-purpose token in the implicit flow?</span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;"><br></span></font></div><div><font class="Apple-style-span" face="BitstreamVeraSans"><span class="Apple-style-span" style="font-size: 13px;">Here is an example of how the flows may look like (I hope it do not include too many errors):</span></font></div><div><span class="Apple-style-span" style="font-family: 'Trebuchet MS', Helvetica, sans-serif; font-size: 13px; "><h1 style="font-weight: bolder; text-shadow: rgb(221, 221, 221) 3px 3px 5px; color: rgb(51, 51, 51); ">Walkthrough of the OpenID Connect <em style="margin-top: 0px; ">more streamlined with OAuth</em>-Approach</h1><p>Using the OAuth approach of obtaining two tokens (by the use of a refresh token), we gain the flexibility of both having the user data token and the session (id) token as two completely independent tokens; and in other use cases (like in implicit grant) have a shared multi-scoped token for use on both services.</p><h2 style="color: rgb(34, 34, 34); text-shadow: rgb(221, 221, 221) 3px 3px 5px; ">Authorization Code Flow</h2><p>Client prepares an <em style="margin-top: 0px; ">authorization request</em>:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">GET /authorization?
response_type=code&
cliend_id=ab1&
scope=openid-session%20openid-userdata HTTP/1.1
Host: <a href="http://rp.example.com">rp.example.com</a>
</code></pre><p>The user logs in, performs consent, etc. and the user agent is redirected back to the RP with the following response:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">GET /callback?
code=BBB3330
Host: <a href="http://consumer.example.org">consumer.example.org</a>
</code></pre><h3 style="color: rgb(51, 51, 51); text-shadow: rgb(221, 221, 221) 3px 3px 5px; ">Obtaining an session access token, and getting the ID Token</h3><p>The client uses the access token endpoint to resolve an <strong style="margin-top: 0px; ">openid-session</strong> token:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">POST /token
Host: <a href="http://rp.example.org">rp.example.org</a>
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
grant_type=authorization_code&
code=BBB3330&
scope=openid-session
</code></pre><p>The provider responds by issuing an <strong style="margin-top: 0px; ">openid-session</strong> access token, and also an <code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); ">refresh_token</code>.</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8 Cache-Control: no-store
Pragma: no-cache
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"bearer",
"scope": "openid-session",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA"
}
</code></pre><p>Note: the <strong style="margin-top: 0px; ">openid-session</strong> access token is transparent and <strong>NOT an JWT</strong>. It may be exchanged for a JWT using the <em>check session service</em>.</p><p>The provider obtains the ID Token using the <strong style="margin-top: 0px; ">openid-session</strong> access token; performing a request to the check session endpoint; a basic OAuth protected endpoint:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">POST /check_session HTTP/1.1
Accept: application/jwt
Authorization: Basic 2YotnFZFEjr1zCsicMWpAA
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
</code></pre><p>The provider returns an JWT (because of the Accept header, may also return unsigned JSON):</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">Content-Type: application/jwt;charset=UTF-8
eyJpc3MiOi.Jqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogIm.h0dHA6Ly9le
</code></pre><p>And the returned JWT may be decoded (and validated) by the client to something like:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">{
"issuer":"<a href="http://server.example.com">http://server.example.com</a>",
"client_id","<a href="http://client.example.com">http://client.example.com</a>",
"audience", "<a href="http://client.example.com">http://client.example.com</a>",
"user_id":"user_328723",
"exp":1303852880
}
</code></pre><h3 style="color: rgb(51, 51, 51); text-shadow: rgb(221, 221, 221) 3px 3px 5px; ">Obtaining an user data access token, and getting the user data</h3><p>The client uses the already obtained <code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">refresh_token</code> when accessing the <em>OAuth Token Service</em>, and requests the scope <strong>openid-userdata</strong>:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">POST /token
Host: <a href="http://rp.example.org">rp.example.org</a>
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
grant_type=refresh_token&
refresh_token=tGzv3JOkF0XG5Qx2TlKWIA&
scope=openid-userdata
</code></pre><p>The provider responds by issuing an <strong style="margin-top: 0px; ">openid-userdata</strong> Access Token:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8 Cache-Control: no-store
Pragma: no-cache
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"scope": "openid-userdata",
"token_type":"bearer",
"expires_in":3600,
}
</code></pre><p>The consumer, uses the OAuth protected user data endpoint to retrieve user data:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">POST /user_info HTTP/1.1
Accept: application/jwt
Authorization: Basic 2YotnFZFEjr1zCsicMWpAA
Content-Type: application/x-www-form-urlencoded
schema=openid
</code></pre><p>The provider returns an JWT (because of the <code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">Accept</code> header, may also return unsigned JSON):</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">Content-Type: application/jwt;charset=UTF-8
eyJpc3MiOi.Jqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogIm.h0dHA6Ly9le
</code></pre><p>And the returned JWT may be decoded (and validated) by the client to something like:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">{
"id": "90125",
"name": "Jonathan Q. Doe"
"given_name": "Jonathan",
"middle_name": "Q.",
"family_name": "Doe",
"nickname": "John",
"email": "<a href="mailto:johndoe@example.com">johndoe@example.com</a>",
"verified": true,
"profile": "<a href="http://example.com/johndoe/">http://example.com/johndoe/</a>",
"picture": "<a href="http://example.com/johndoe/me.jpg">http://example.com/johndoe/me.jpg</a>",
"website": "<a href="http://john.doe.blogs.example.net/">http://john.doe.blogs.example.net/</a>",
"gender": "male",
"birthday": "05/02/0000",
"zoneinfo": "America/Los_Angeles"
"locale": "en_US",
"phone_number": "+1 (425) 555-1212",
"address": {
"region": "WA",
"country": "United States"
},
"last_updated": "2011-06-29T21:10:22+0000"
}
</code></pre><h2 style="color: rgb(34, 34, 34); text-shadow: rgb(221, 221, 221) 3px 3px 5px; ">Implicit Flow</h2><p>The consumer, performs an authentication request:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">GET /authorization?
response_type=token&
cliend_id=ab1&
scope=openid-session%20openid-userdata HTTP/1.1
Host: <a href="http://rp.example.com">rp.example.com</a>
</code></pre><p>The user logs in, performs consent, etc. and the user agent is redirected back to the RP with the following response:</p><pre style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; padding-top: 10px; padding-right: 10px; padding-bottom: 10px; padding-left: 20px; background-color: rgb(240, 240, 240); border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 203, 186); border-right-color: rgb(204, 203, 186); border-bottom-color: rgb(204, 203, 186); border-left-color: rgb(204, 203, 186); "><code style="font-size: 12px; font-family: LuxiMono, 'Bitstream Vera Sans Mono', Monaco, 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; color: rgb(28, 54, 12); margin-top: 0px; ">HTTP/1.1 302 Found
Location: <a href="http://consumer.example.org/callback#access_token=2YotnFZFEjr1zCsicMWpAA">http://consumer.example.org/callback#access_token=2YotnFZFEjr1zCsicMWpAA</a>
&scope=openid-session%20openid-userdata&state=xyz&token_type=bearer&expires_in=3600
</code></pre><p>Then the consumer got an Access Token that is valid at both the User Data service and at the Session Service.</p><p>The user agent may send the access token to the web protected resource, and the web protected resource will use the access token with both the user info and session info service.</p></span></div></body></html>