Spec not clear as to which auth flows are supported

[Dave Tonge]

e..g Authorization Code Flow, Implicit Flow, Hybrid Flow We should be explicit as to what we support

[Nat Sakimura]

Since we agreed that we need to have both the request and response signed, only the viable flow is the Hybrid Flow.

[Dave Tonge]

We discussed on the call that I will make a pull request with a clarification

[Nat Sakimura]

Just waiting for a pull request.

[Sascha Preibisch]

Please provide the location where this should be fixed or updated.

[Dave Tonge]

Actually I think its a bit clearer now:

shall require the response_type values code id_token or code id_token token;
shall return ID Token as a detached signature to the authorization response;
shall include state hash, s_hash, in the ID Token to protect the state value;

I think we can close this.

[Nat Sakimura]

Going to close this.