Messages 2.1.2.1.1.1 - Spec not clear that user_id claim must be explicitly requested in userinfo claims member

[Michael Jones]

The spec should make it clear that when a request object is being used specifiying specific claims with the claims member, that the user_id claim is just another claim and must be requested, if wanted.

[Michael Jones]

The general issue here is whether the claims listed in the request object replace those that may be requested by scope values or add to them.

The one issue with making them additive is that scopes aren't signed but the request object is. We didn't see this as a major problem.

The working group consensus was to make the claims requested by scopes and in the request object additive.

[Michael Jones]

Fix #547 Messages 2.1.2.1.1.1 - Spec not clear that user_id claim must be explicitly requested in userinfo claims member Now requested claims add to those requested with scope values, rather than replacing them.

→ deaff78acfcd