Use Bearer in token_type in Implicit Flow response example

[Iván Perdomo]

The section "Successful Token Response" (http://openid.net/specs/openid-connect-core-1_0.html#TokenResponse) states that the token_type MUST be Bearer as as specified in OAuth 2.0 Bearer Token Usage [RFC6750]. However there is another example that uses bearer in token_type. See section 3.2.2.5 "Successful Authentication Response" (http://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthResponse)

  HTTP/1.1 302 Found
  Location: https://client.example.org/cb#
    access_token=SlAV32hkKG
    &token_type=bearer
    &id_token=eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
    &expires_in=3600
    &state=af0ifjsldkj

That example does not follow the RFC6750

[Michael Jones]

http://tools.ietf.org/html/rfc6749#section-4.2.2 says that the identifier is case-insensitive. So the example is actually correct as-is.

We should discuss whether to change the example to use the registered case or whether to demonstrate, by example, that the value is case-insensitive.

[John Bradley]

Leave the example as is but add a comment to the text that the value is case insensitive.

[Michael Jones]

Fixed #985 - Noted that the token_type value is case insensitive

→ <<cset 4ce0f6cb1b62>>

[Ray Luo]

Hi Mr. Jones, thanks for clarifying this confusing topic by your unambiguous commit!

But those changes have not (yet?) been published to the OIDC specs hosted on openid.net, for example, not in this “3.1.3.3. Successful Token Response“ section (https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse). In fact, the metadata at the very top of that published specs contains some keywords like “Final”, “November 8, 2014”, “OpenID Connect Core 1.0 incorporating errata set 1“. Is it really up-to-date?

PS: I work for Microsoft and maintain one of its authentication SDK. Would like to better understand this specs. Thanks for your time reading this.