OIDC in 4.1.0 and problems with claims

[Cantor, Scott]

Attribute consent? Stored where?

The back channel calls honor consent, but they have to find the records to do that, or I believe you can also toggle an option to store the record in the access token so that in theory it allows for client storage with it.

I don't know how to disable the check if you don't have consent on, but it may be an issue of defaults not lining up like they should, though that's somewhat irrelevant for an upgrade. If consent isn't on (*), then you'd presumably have to disable the check for that on the back channel.

This did change in the new code because it wasn't implemented correctly on the back-channel before.

-- Scott

(*) Yes, I'm aware the spec "requires" consent, but that's obviously nonsense, it's unenforceable and never belonged in the protocol itself.