Decision Proposal 132 - Required ID Token claims

[CDR-API-Stream]

The final decision document has been reviewed and approved by the Data Standards Chair. It is attached below:
Decision Proposal 132 - Mandatory Claims for ID Token.pdf.

This change will be included in the next Consumer Data Standards release v1.4.0.

---

The related change request is: Urgent documentation change required: content of ID Token as agreed in the outcomes of a workshop held on 5th June 2020.

This decision outlines a recommendation to align to normative standards.

The change will remove the following text in the Token section of the standards:

As described under section 5.2.2 of the [FAPI-RW] profile, ID Tokens MUST include the following claims (in addition to the mandatory claims specified in section 2 of the [OIDC] standard) as part of Hybrid Flow authentication:

• nonce: String value used to associate a Client session with an ID Token.
• s_hash: Hash of the state value.
• c_hash: Hash of the authorisation_code value.

And replace it with:

In addition to the mandatory claims specified in section 2 of the [OIDC] standard, required claims for ID Tokens as part of Hybrid Flow authentication must align to section 3.3 (Authentication using the Hybrid Flow) of the [OIDC] standards and sections 5.2.2 and 8.4.3 of the [FAPI-RW] profile.

[CDR-API-Stream]

The final decision document has been reviewed and approved by the Data Standards Chair and it is included in the issue above.