Unsolicited SSO handler for OIDC?

[Cantor, Scott]

> One can compose a request pointing to the OIDC
> profile handler of an IdP but this request requires nonce and
> state  parameters as far as I know. For these parameters to
> be available the user always has to start at the OIDC RP I
> understand.

That's what I meant by whether the RP would accept an unsolicited response or not.

RelayState and state are the same thing, and nobody claims SAML doesn't support this because of RelayState. It's simply optional and ultimately up to the RP what happens if you omit it or mock a value up, and whether the RP checks the nonce is also ultimately a matter of policy.

> Well, it's also quite useful for our use case in which users are
> sent  users to some page e.g. to add some attributes to their
> account and then  redirect them via the IdP

That's better handled as a third-party-initiated request, which I defined in SAML (but was never supported by anyone else, per usual). And that also exists in OIDC.

When you want a request to happen, it's always best to let the RP handle it.

-- Scott