Core Section 3 - id_token parameter for login initiation endpoint

[John Bradley]

For Core Section 3 I would like to add the following optional parameter to the login initiation endpoint.

id_token OPTIONAL. If the initiator is the iss then it may include an initial id_token. The value of exp SHOULD be set to a small value in the range of 5 minutes. The id_token must contain a valid aud restricting it to the client receiving it. If the client receives a value for this string-valued parameter, it MUST include it in the subsequent authorization request as the id_token_hint parameter value.

I have been getting push back from people looking to convert from SAML that Connect forces many more round trips than SAML for doing IdP initiated login.
Sending an initial short lived id_token lets the client do the quick customization of the UI that the id_token was intended to enable while allowing the client to get access tokens and a new id_token in the background using prompt=none.

This also reduces the eventual pressure to add more parameters to the endpoint as the AS can tack on additional claims it needs to maintain state.

I think we did have the id_token as a parameter at wine point then changed it to the login_hint when that was added to make it more general.

I know this is a late addition request.

[Michael Jones]

We will handle this as per the 2-Dec-13 call: Adding support for HTML form post but not adding the new parameter for now. It can be added later in an extension, after sufficient security analysis.

[Michael Jones]

The resolution to this issue is to allow third party login request parameters to be sent via HTML form post.

[Michael Jones]

Fixed #904 - Allowed third party login request parameters to be sent via HTML form post.

→ <<cset ce2ca171efd1>>