OIDC OP 3.4 and issueIdTokenViaRefreshToken

Cantor, Scott cantor.2 at osu.edu
Mon Jul 31 22:47:04 UTC 2023


> Could there be a bug in the default value for this property when implicitly
> set in the OIDC SSO flow? It definitely returned an ID token in 3.3.0 without
> enabling the token flow. I can file a bug if you like.

The logic derives a value of false if the active profile configuration isn't the expected type.

I guess that's a bug, but the ability to leave out the token profile bean is largely a compatibility thing, it was meant to be temporary and would eventually probably be disallowed.

-- Scott




More information about the users mailing list