Standard - 5.1.2.1 Inconsistency with Messages

[OpenID Foundation]

Section 5.1.2.1:

The assertion is a JSON structure which MUST contain the following values:

id_token The ID Token associated with the authentication session.

This does not match the Messages document, that states that this parameter is REQUIRED only if the response_type id_token was present in the request.

[hideki nara]

I think that Standard and Basic should refer to Message anyway.

[Nat Sakimura]

Fixed the specs so that:

response_type=code => token endpoint always returns id_token.

response_type=token => only access_token is returned from authz endpoint in the fragment

response_type includes id_token => id_token is returned from authz endpoint in the fragment

code is always returned in query string.

[Edmund Jay]

fixes #31 Standard - 5.1.2.1 Inconsistency with Messages

→ 8ae604b60eb6