Messages - 2.1.2.1.2 user_id definition

The current definition does not exactly define what it is. It only defines what to do if the user is not authenticated.

One possible definition :

{{{ Specifies the End-User identifier (which MAY be a PPID?) that MUST be authenticated by the Authorization Server. If the specified user is not currently authenticated to the Authorization Server, they may be prompted for authenticated, unless the prompt parameter in the Authorization Request is set to "none". The Claim Value in the request is object containing the single element value }}}

Also it is currently written under the paragraph

Following Claims MAY be requested in the ID Token by specifying it in the "claims" member:

user_id is always returned in the ID Token. In this case, it acts more like the max_age parameter. I think it should be moved closer to the max_age parameter under the paragraph

In addition to the "claims" member, these additional members are defined within the "id_token" member of the OpenID Request Object:

Also, why must the claim value be an object? Can't it just be the actual value like the max_age parameter?

Comments (2)