[Openid-specs-fapi] Issue #621: FAPI CIBA (openid/fapi)

[dgtonge]

New issue 621: FAPI CIBA
https://bitbucket.org/openid/fapi/issues/621/fapi-ciba

Dave Tonge:

We have this clause:

> shall ensure the Authorization Server has authenticated the user to an appropriate level for the client's intended purpose.

Tim asked:

> How is the client supposed to do this? I guess this was written with `acr` in mind, or is there any other standardized mechanism \(apart from checking AS policies\) to consider?

‌