Messages - new response_type = id_token userinfo

[Nat Sakimura]

In a scenario like IdP on a smartphone, user info access happens in the front channel, which results in a extra redirect dance, creating bad user experience, We can avoid it by having userinfo token returned with id_token. This is in line with what Microsoft requested in a different context, so it warrants valid use case that we may want to incorporate.

This would mean new response type

• id_token userinfo
• token id_token userinfo
• code id_token userinfo

[Michael Jones]

Doing this would satisfy issue #281 Obtaining claims without requiring additional round trips

[Nat Sakimura]

instead of response_type including 'userinfo' for separate token, use scope to request flat id_token that includes userinfo response.

This is conditional on the evaluation of session management.

Exact scope name to indicate the flat id_token request is to be determined by editors group.

[Nat Sakimura]

Nothing of importance was noted during the session management editing spec, so we should proceed.

Scope name is TBD.

[Nat Sakimura]

claims_in_id_token as the scope name.

[Nat Sakimura]

Issue #281 was marked as a duplicate of this issue.

[Nat Sakimura]

Fix #561. Added scope value claims_in_id_token as a switch to indicate claims shoudl go into id_token

→ 4cad92c1c34a