<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap:break-word;line-break:after-white-space"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">FWIW - we actually also found that “side note” pretty late while implementing IdentityServer - it fundamentally changed our design. And yes - we get a lot of question about the fact that suddenly claims are “missing” once they switch e.g. from id_token to code id_token.</div> <br> <div id="bloop_sign_1529470214223662848" class="bloop_sign"><div>Cheers </div><div>-------</div><div>Dominick Baier</div></div> <br><p class="airmail_on">On 19. June 2018 at 21:57:15, Filip Skokan via Openid-specs-ab (<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<title></title>
<div dir="ltr">I agree the specification is clear. But it's very
easy to miss this and I believe it to be the general expectation
from developers that requesting claims using the scopes parameter
makes these available in the id_token regardless of the
response_type used. A note in each ID Token section would make this
more clear.
<div><br></div>
<div>Also, <b>Section 5.4 Requesting Claims using Scope
Values</b> (<a href="http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims">http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims</a>)
enumerates the spec-defined (recommended) scopes `profile, email,
address, and phone` but does not mention what is the expected
behaviour for other claims related to OP-specific (custom)
scopes. </div>
<div>e.g. an OP has a custom scope `birthdate` with which it
returns `birthdate` and `<a href="http://op.example.com/birthdate_verified`">http://op.example.com/birthdate_verified`</a>
claims. When requesting these claims using the scope parameter,
does the same apply and these are only present in the ID Token when
response_type=id_token?</div>
<div>
<div>
<div><br clear="all">
<div>
<div dir="ltr" class="gmail-m_-8865412240653463423gmail_signature">
Best,<br>
<b>Filip</b></div>
</div>
<br></div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Jun 19, 2018 at 6:51 PM Thomas Broyer via
Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>>
wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><br>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Jun 19, 2018 at 2:54 PM Nat Sakimura via
Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>>
wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto">I received the following message at the OIDF
Facebook page. </div>
<div dir="auto">Perhaps could someone take care of it? </div>
<div dir="auto"><br></div>
<div dir="auto"><br></div>
<div dir="auto"><br></div>
<div dir="auto">Can you please take a look at <a href="https://stackoverflow.com/questions/50740532/should-id-token-contain-claims-when-used-during-authorization-code-flow" target="_blank">https://stackoverflow.com/questions/50740532/should-id-token-contain-claims-when-used-during-authorization-code-flow</a>
and give your response there?</div>
<div dir="auto"><br></div>
<div dir="auto">Multiple authorization providers implementing oidc
have this implemented differently - sometimes id_token contains
claims when access_token is returned, sometimes not and call to
userInfo is required, sometimes it is in both userInfo and id_token
which is quite confusing why this is in multiple places, what is
the reasoning behind it. In my opinion this should be clarified in
the documentation, how it should be implemented according to openid
standard.</div>
</blockquote>
<div><br></div>
<div>Fwiw, I don't think it needs clarification: <a href="https://stackoverflow.com/a/50930696/116472" target="_blank">https://stackoverflow.com/a/50930696/116472</a> </div>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote>
</div>
_______________________________________________
<br>Openid-specs-ab mailing list
<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
<br></div></div></span></blockquote></body></html>