Open zandbelt opened 4 years ago
one of the things in there should be about:
rp-init-logout-no-state and rp-init-logout-other-state What if the RP does not use/provide state? Can we say something like this test is "optional, but required when providing state”.
https://openid.net/wordpress-content/uploads/2018/06/OpenID-Connect-Conformance-Profiles.pdf does not have the logout profiles yet for OP and RP