<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">At the moment how to request a id_token for a third party is unspecified. We wanted to document azp in the core specs for security reasons, to prevent clients from mistakenly accepting tokens with azp set when they are expecting them to come directly from the issuer.<div><br></div><div>There is work on this happening in the Native Applications WG (NAPPS) where the request mechanism may be standardized for interoperability. At the moment there are a number of custom things like overloading scopes that people are using.</div><div><br></div><div>John B.<br><div><div>On Jun 5, 2013, at 2:03 PM, Pedro Felix <<a href="mailto:pmhsfelix@gmail.com">pmhsfelix@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">The ID Token format has support to separate the token audience ("aud") from the authorized party ("azp").<div style=""><br></div><div style="">As an example, the Google API authorization uses this to differentiate between the mobile client requesting the id_token + code (the "azp") and the back-end server that will obtain the access_token and use the id claims (the "aud").</div>
<div style="">Since there are now *two* client_id involved, the Google API adds the back-end server client_id to the authorization request scope parameter (e.g. scope="<span style="font-family:Arial,sans-serif;font-size:13px;line-height:21px">audience:server:client_id:some_client_id other_scope" [1]).</span></div>
<div style=""><br></div><div style="">However, I did not found any similar mechanism on the OpenID Connect specs. So, how can an authorization request define these two client_ids?</div><div style=""><br></div><div style="">Thanks</div>
<div style="">Pedro</div><div style=""><br></div><div style="">[1] - <a href="https://developers.google.com/accounts/docs/CrossClientAuth#offlineAccess">https://developers.google.com/accounts/docs/CrossClientAuth</a></div></div>
_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br></blockquote></div><br></div></body></html>