OIDC attribute ("claim") release best practices

[Cantor, Scott]

> Our security group considers the campus numeric identifier (yes, the one
> printed on ID cards) "confidential data". I will say no more...

Ooof. I had to fight off a similar effort from a complete imbecile here, and I was pretty close to telling them "him or me" if they went there.

> Thanks, that was an unexpected laugh. Fortunately, I imagine OAuth prison
> will have a window whose bars were inadvertently made of cardboard
> tubes ;).

You got me.

-- Scott