OAuth Happy Hour

Join Aaron Parecki and Lee Brandt from Okta for an hour of live Q&A about all things OAuth and OpenID Connect! Bring your questions, or just come to learn about what's new!

Today we'll be focusing on scopes and claims in OAuth!

[RoterFruchtZwerg]

Regarding 23:50 : the id_token is not required during the redirection (if only response_type=code is set), but it is required on the /token endpoint as soon as the "openid" scope was granted, if I understand it correctly. Thus, a basic OAuth provider cannot be compatible with OIDC despite the fact it could implement the /userinfo endpoint for the "openid" scope. If the id_token was optional, OIDC could be implemented with a basic OAuth provider.
It is a little bit frustrating that OIDC really is incompatible with OAuth. I would have preferred a standard /userinfo endpoint on top of OAuth and an optional id_token for those who support it.

[gobindrawat]

If ID token which application requires in order to learn about the user claim then what is the benefit of Userinfo Endpoint ? What is the difference between the information which application gets from ID Token and Userinfo Endpoint . Thanks