Repository navigation
Parameter "id_token_hint" is ignored #88
Description
According https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1
id_token_hint is a ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client.
This parameter is ignored
Activity
mrvanes commentedon Dec 2, 2024
Currently Microsoft has an External Authentication Method [1] in preview that allows 3rd party OIDC providers to provide Entra ID MFA for Azure based applications. The authorization call contains a signed id_token_hint that needs to be parsed and verified and requires the OP to return the authorization result as a form_post.
It would be nice if the simpleSAMLphp OIDC module would support these requests.
[1] https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider#microsoft-entra-id-call-to-the-external-identity-provider
cicnavi commentedon Dec 3, 2024
Note for response mode related specs:
cicnavi commentedon Jul 12, 2026
Support for
form_postmode has been added in #337cicnavi commentedon Jul 25, 2026
Prepared in 12fb304 and d18509f