Closed apinder closed 6 years ago
It is something that the MAL and Reference Model have covered so it is not something we need to be concerned about.
Basically if they don't do that then the security system in use (if done correctly) wouldn't allow then to do anything else. The reference model covers this I think.
The below requirement can be asserted in the tests however it is outside the scope of the Login service as it must be asserted on the consumer which would have no effect on the implementation of the login service (even if it must be adhered to by users of the login service):
This also leads to the question of how we ensure all users/consumers of the login service comply to the requirement of setting the auth ID based on the last login response or do we leave that responsibility to each user/consumer?