search

ncsa / oa4mp

Open Authorization for MyProxy
https://oa4mp.org/
Other
8 stars 10 forks source link

Client should not check if an ID token was returned for pure OAuth clients on refresh #157

Closed jjg-123 closed 8 months ago

jjg-123 commented 8 months ago

The server correctly does not return an ID token if the client is OAuth only -- ID tokens require an OIDC client. The OA4MP client code, however, still checks if the ID token was returned from a refresh and fails. It should query if the client is OIDC and not check.