<div dir="ltr">Dear Justin,<br><br>Thank you for your reply. I could confirm my interpretation was not wrong. My implementation behaves in the same way. Thank you.<br><br>Best Regards,<br>Takahiko Kawasaki<br></div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-08 22:52 GMT+09:00 Nat Sakimura <span dir="ltr"><<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">+1</div><br><div class="gmail_quote"><div dir="ltr">2016年2月8日(月) 21:53 Justin Richer <<a href="mailto:jricher@mit.edu" target="_blank">jricher@mit.edu</a>>:<br></div><div><div class="h5"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Your interpretation is correct, the token must have the "openid"
scope. Our implementation will return an error from the userinfo
endpoint if a token is used without the "openid" scope there.</div><div bgcolor="#FFFFFF" text="#000000"><br>
<br>
-- Justin</div><div bgcolor="#FFFFFF" text="#000000"><br>
<br>
<div>On 2/8/2016 3:37 AM, Takahiko Kawasaki
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Hello,<br>
<br>
I have a question about an access token to access a UserInfo
endpoint.<br>
<br>
OpenID Connect Core 1.0, 5.3.1. UserInfo Request says as
follows.<br>
<br>
The Access Token obtained from an OpenID Connect
Authentication<br>
Request MUST be sent as a Bearer Token, per Section 2 of
OAuth<br>
2.0 Bearer Token Usage [RFC6750]. <br>
<br>
If an access token is issued via 'OpenID Connect Authentication
Request' (not via a pure OAuth 2.0 authorization request),
'scope' must contain 'openid' (3.1.2.1. Authentication Request).
Therefore, my interpretation is that an access token to access a
UserInfo endpoint must cover 'openid' scope.<br>
<br>
Is this interpretation appropriate? Or, Is it allowed to return
user information from a UserInfo endpoint even when an access
token presented by a client application does not cover 'openid'
scope? How do existing implementations behave?<br>
<br>
Best Regards,<br>
Takahiko Kawasaki<br>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
Openid-specs-ab mailing list
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<br>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div></div></div>
</blockquote></div><br></div>