Basic 2.4.2, Messages 2.4.2 - Question about requirement that UserInfo response be JSON

[Michael Jones]

Yaron Goland writes: "2.4.2 - Why is there a requirement that the response MUST be JSON unless something else was registered? Why can't normal HTTP negotiation semantics apply?"

I don't anticipate a change to the spec for this, but it's a fair question that we should try to answer.

[John Bradley]

Reasonable point, the client could discover the supported formats and use content negotiation rather than registration.

[Michael Jones]

Having the IdP conduct dynamic content negation seems overly complex. Doing this at registration time also allows the client to be simpler.

Making this change seems to add complexity out of proportion to the value provided.