Hi all, Issuing an ID-JAG is an event that conveys a user identity most often across organizational boundaries. In a way, it is like indirectly issuing an access token.
I can see consumer scenarios where this might require user consent. However, I don't know if the current draft allows for that. I've filed this issue to discuss it: https://github.com/oauth-wg/oauth-identity-assertion-authz-grant/issues/139 Atul
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
