Messages 2.2.3 id_token MUST NOT be returned if the grant_type is not authorization_code

[John Bradley]

We should relax this to allow id_tokens to be returned for refresh or assertions.

The id_token for refresh tokens is the one that was for the session that generated the refresh token.

[Brian Campbell]

What's motivating wanting this change?

Also, associated a web session with a refresh token is going to be difficult or impossible for some implementations.

[Former user]

To me, the id_token is always associated with the front end session, and should NOT be refreshed with the refresh token.

[Michael Jones]

We can say that the id_token MUST be returned when the grant_type is authorization_code and MAY be returned for other grant_types.

People will think about security considerations.

[Michael Jones]

Fixed #787 - Don't prohibit returning an ID Token from the Token Endpoint when grant types other than "authorization_code" are used.

→ <<cset 97d3f21a394e>>