4 ms·
The OIDC "id token" is a JWT that contains identity assertions, just like SAML would. You can go fetch the profile via HTTP, but that's mostly because major pro
by lvh 7y ago
The OIDC "id token" is a JWT that contains identity assertions, just like SAML would. You can go fetch the profile via HTTP, but that's mostly because major providers have quietly conceded that JWT is a nightmare, and encoded that fact in their API.
- throwaway3157 7y agoWhat do you mean here? Encoded in their API? And If they don’t like JWT, why don’t they use something else?
- lvh 7y agoMajor IdPs tend to provide an endpoint where you can send them the JWT, they validate it and return its contents as a plain JSON response. You're effectively trading JWT parsing for HTTPS. They can't walk JWT back now without breaking existing apps, because parsing it yourself was advertised as an option.