Standard - 2.2.6.1 Add ID Token Validation text

[Nat Sakimura]

It references Section 2.1.2 of OpenID Connect Messages 1.0 as what is being returned using this binding.

IMHO, it is rather important to call out the validation section as well, since reader may just think "oh that's just a format" and does not follow the validation requirement set forth in Section 4 of OpenID Connect Messages 1.0 here as well.

Also, the validation section may call out the HTTP specific precautions, such as checking the binding between the state parameter or nonce to cookie, etc.

[Michael Jones]

Again, please supply the precise text that you want to appear where.

[Nat Sakimura]

Nat to provide the text.

[Nat Sakimura]

Insert the following as the 3rd paragraph:

The client MUST validate the response as follows:

Case 1: response_type=code

1. Follow all the verification rules in RFC 6749.

Case 2: response_type=token id_token

1. Follow all the verification rules in RFC 6749.
2. Follow the validation rules in 4.2 and 4.4 of Messages [OpenID.Messages]

Case 3: response_type=code id_token

1. Follow all the verification rules in RFC 6749.
2. Follow the validation rules in 4.2 and 4.5 of Messages [OpenID.Messages]

Case 4: response_type=token code

1. Follow all the verification rules in RFC 6749.

Case 5: response_type=token code id_token

1. Follow all the verification rules in RFC 6749.
2. Follow the validation rules in 4.2, 4.3, and 4.5 of Messages [OpenID.Messages]

BTW we seem to use 'verification' and 'validation' almost interchangeably. Should we just standardize on 'verification'?

According to OED,

verification, n.

1. The action of demonstrating or proving to be true or legitimate by means of evidence or testimony; formal assertion of truth. Now rare.
2. Demonstration of truth or correctness by facts or circumstances.
3. a. The action of establishing or testing the truth or correctness of a fact, theory, statement, etc., by means of special investigation or comparison of data. b. The action of verifying or testing the accuracy of an instrument, or the quality of goods. Also attrib.

validation, n.

a. The action of validating or making valid.

So, here, we actually are talking about verification and not validation.

[Michael Jones]

We shouldn't standardize on "verification", for the reasons that led to issue #666 and the edits to resolve it. Given they mean different things, we should keep using the correct term in the correct place for the intended meaning in that context.

Thanks for supplying the specific text. I'll apply it shortly.

[Nat Sakimura]

In view of the verification v.s. validation discussion, I amend my proposed text to the following:

The client MUST validate the response as follows:

Case 1: response_type=code

1. Validate the response according to RFC 6749, especially that of section 4.1.2 and 10.12.

Case 2: response_type=token id_token

1. Verify that the response conforms to Section 5. of [OAuth.Responses]
2. Follow all the validation rules in RFC 6749, especially that of section 4.2.2 and 10.12.
3. Follow the validation rules in 4.2 and 4.4 of Messages [OpenID.Messages]

Case 3: response_type=code id_token

1. Verify that the response conforms to Section 5. of [OAuth.Responses]
2. Follow all the validation rules in RFC 6749, especially that of section 4.2.2 and 10.12.
3. Follow the validation rules in 4.2 and 4.5 of Messages [OpenID.Messages]

Case 4: response_type=token code

1. Verify that the response conforms to Section 5. of [OAuth.Responses]
2. Follow all the validation rules in RFC 6749, especially that of section 4.2.2 and 10.12.

Case 5: response_type=token code id_token

1. Verify that the response conforms to Section 5. of [OAuth.Responses]
2. Follow all the validation rules in RFC 6749, especially that of section 4.2.2 and 10.12.
3. Follow the validation rules in 4.2, 4.3, and 4.5 of Messages [OpenID.Messages]

[Michael Jones]

Perfect. I'll add this as written.

[Michael Jones]

Fixed #841 - Described verification requirements for Authorization Server responses.

→ <<cset 0acb39df11ff>>

[Michael Jones]

Nat, please review. I added the missing case 6. Also, it seems that we're missing case 7 - response_type=id_token in both the example and the validation section. I believe that we need to add these.

[Michael Jones]

We will move the new text before the non-normative examples. We will also add "case 7: response_type=id_token".

[Michael Jones]

Fixed in edit https://bitbucket.org/openid/connect/commits/6e8cc28e4d90fdb688bf3df6448ec8e31cd44ba1