Spec not clear as to which auth flows are supported

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2017-03-02

e..g Authorization Code Flow, Implicit Flow, Hybrid Flow
We should be explicit as to what we support

---

Bitbucket status: closed

Bitbucket origin: issue 72

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2017-03-02

Since we agreed that we need to have both the request and response signed, only the viable flow is the Hybrid Flow.

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2017-03-30

We discussed on the call that I will make a pull request with a clarification

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2017-04-04

Just waiting for a pull request.

[bitbucket-import-issues]

Originally submitted by SaschaZeGerman (Sascha Preibisch) on 2017-04-25

Please provide the location where this should be fixed or updated.

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2017-04-26

Actually I think its a bit clearer now:

shall require the response_type values code id_token or code id_token token;
shall return ID Token as a detached signature to the authorization response;
shall include state hash, s_hash, in the ID Token to protect the state value;

I think we can close this.

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2017-04-26

Going to close this.