Basic and maybe Messages and Standard - Several problems with statement about UserInfo response not guaranteed to be about the Subject in the session

[Michael Jones]

First, the term Subject is not defined, and yet it is used in the following statement:

NOTE: The UserInfo Endpoint response is not guaranteed to be about the Subject in the session. Therefore, it MUST NOT be used as an assertion about the user in the session unless the user_id matches the user_id in the ID Token.

It would be better to place normative requirements on implementations to compare the user_id values in the UserInfo endpoint response and the ID Token than to just give a warning.

Second, if this statement/requirement needs to be in Basic, is should be in Messages and/or Standard as well.

[Nat Sakimura]

Implicit flow needs it also in Standard.

[John Bradley]

re #310 remove language about subject

→ 2fe3cf6d2da3

[John Bradley]

re #310 user info example to include user_id fix language about user info response format, add media type.

→ ebed7194bd3c

[John Bradley]

re #310 add requirement to compare user_id from user info endpoint to id_token re #310 user info example to include user_id fix language about user info response format, add media type.

→ 55bdda096af0

[John Bradley]

re #310 add requirement to compare user_id from user info endpoint to id_token re #310 user info example to include user_id fix language about user info response format, add media type.

→ 55bdda096af0

[John Bradley]

Fixes #310 add requirement to compare user_id from user info endpoint to id_token re #310 user info example to include user_id

→ 2664876a0fd7

[John Bradley]

Fixes #310 add requirement to compare user_id from user info endpoint to id_token re #310 user info example to include user_id

→ 2664876a0fd7