[
https://issues.apache.org/jira/browse/CXF-8413?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Colm O hEigeartaigh resolved CXF-8413.
--------------------------------------
Resolution: Not A Problem
> OIDC Implicit Flow: id_token not returned if other response types are included
> ------------------------------------------------------------------------------
>
> Key: CXF-8413
> URL: https://issues.apache.org/jira/browse/CXF-8413
> Project: CXF
> Issue Type: Bug
> Components: JAX-RS Security
> Affects Versions: 3.4.2
> Reporter: Will Croteau
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Labels: OIDC
>
> Per the [OIDC
> Specification|https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Combinations]:
> {quote}id_token token
> When supplied as the value for the response_type parameter, a successful
> response MUST include an Access Token, an Access Token Type, and an id_token.
> The default Response Mode for this Response Type is the fragment encoding and
> the query encoding MUST NOT be used. Both successful and error responses
> SHOULD be returned using the supplied Response Mode, or if none is supplied,
> using the default Response Mode.
> {quote}
> OidcImplicitService and OidcHybridService do not include the id_token in the
> response if token is also requested.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
