error_response_missing_openid_scope

[AxelNennker]

What type of PR is this?

Add one of the following kinds:

• correction

What this PR does / why we need it:

Error responses should be returned through the redirect_url if the redirect_url is valid.
Only if the redirect_url is not valid are HTTP response codes used.

Which issue(s) this PR fixes:

Fixes #209

[sebdewet]

Hi,
not feasable in ciba when we won't have a redirect_uri in poll mode.
When a redirect_uri is specified, you want to return the errors in a query string using an HTTP redirect 302 status code ?

[AxelNennker]

Hi, not feasable in ciba when we won't have a redirect_uri in poll mode. When a redirect_uri is specified, you want to return the errors in a query string using an HTTP redirect 302 status code ?

I added a reference to CIBA error handling

[jpengar]

Suggested change

	For OIDC please refer to [OIDC Authentication Error Response](https://openid.net/specs/openid-connect-core-1_0.html#AuthError).
	For the Authorization Code Flow please refer to [OIDC Authentication Error Response](https://openid.net/specs/openid-connect-core-1_0.html#AuthError).

We can say Authorization Code Flow instead of OIDC. CIBA is also OpenId Connect. And the link points to section 3.1.2.6. Authentication Error Response of the OIDC Core standard which is under section 3.1. Authentication using the Authorization Code Flow.

[AxelNennker]

I think CIBA is not OIDC (OpenId Connect). They are separate standards published by the OIDF.

[jpengar]

Yes, of course, it is indeed a separate standard. What I mean is that it is called "OpenID Connect Client-Initiated Backchannel Authentication Flow - Core 1.0", so it looks better (or at least helpful) to me to explicitly mention the Authorization Code Flow instead of OIDC in this case, to avoid misunderstandings.

[jpengar]

But in any case, I don't think it's a big deal, so I've given my approval.

[AxelNennker]

I think the text is now clear about CIBA and OIDC authoritzation code flow, thus adressing @sebdewet 's comment.
Merging this now. And closing.

[sebdewet]

I have a question about the access_denied, is the answer is given on the /authorize call if consent is denied by the end-user, or on the /token call ?