I agree with Roland that all of these nits should be addressed.
From: email@example.com [mailto:firstname.lastname@example.org] On Behalf Of Roland Hedberg Sent: Sunday, January 27, 2013 10:50 AM To: email@example.com Group Subject: [Openid-specs-ab] A couple of additional errata
18.104.22.168 Last sentence of first paragraph: "Supporting it is necessary for implementations that need to request or provide sets of Claims other than the default UserInfo, and ID Token Claim sets."
UserInfo is a link to 2.3 UserInfo Endpoint
but that is not what 'UserInfo' is referring to in the text, it's about the claims set not the endpoint.
5.2 ID Token Validation
Bullet point 10.
"If a nonce value was sent in the Authorization Request, a nonce Claim MUST be present and its value of the checked ..." ^^^^^^
'of the' should be removed.
5.3 Userinfo Response Validation
"To validate the UserInfo response, the Client MUST do the following:
- If the Client has provided a userinfo_encrypted_response_alg parameter during Registration, decrypt the ID Token using the key pair specified during Registration."
Why the ID Token? Isn't it the Userinfo response that is supposed to be encrypted ?