Inconsistent Claims Between Authentication and Token Endpoint ID Tokens in OIDC Hybrid Flow

[aaujayasena]

Description

When using the OIDC hybrid flow there is a discrepancy between the claims in the ID tokens returned by the authentication endpoint and the token endpoint. According to the documentation, the values of common user claims in ID tokens should be identical, and all claims related to the authentication event should be available in both ID tokens [1]. However, the following differences are observed:

Red color content from ID token returned from the authorization endpoint
Green color content is the extended ID token ( Return from Token Endpoint)

Observed Differences:

1. The sid claim is present in the authentication endpoint token but not in the token endpoint token.
2. The nbf claim is present in the token endpoint token but not in the authentication endpoint token.
3. user_org claim present in the authentication endpoint token but not in the token endpoint token.

We need to recheck and finalize these differences are accepted.
[1] https://wso2.com/asgardeo/docs/guides/authentication/oidc/implement-oidc-hybrid-flow/
[2]https://openid.net/specs/openid-connect-core-1_0.html#HybridIDTValidation

Steps to Reproduce

1. Login to console create application
2. Enable hybrid flow
3. Enable code id_token
4. Make a authentication request
   ex: https://localhost:9443/oauth2/authorize?response_type=code id_token&client_id=QsBUsTh7yw2wDT4YATkMU4B0OgAa&nonce=ndb&redirect_uri=https://oidcdebugger.com/debug&scope=openid
5. Retrieve the code and extend the request and retrieve the id_token from the token endpoint
6. Get the ID token from steps 5 and 4 and compare content

Version

IS 7.1.0-m6

Environment Details (with versions)

No response

[Thumimku]

This is behaviour is same for IS 7.0.0 GA also

[Thumimku]

As discussed with @aaujayasena , this is not L2 interms of severity. But we have to prioritise this. Please find the following analysis.

The sid claim -> This is a bug we need to fix, cause if the flow is code flow then we can get the sid claim in ID_token.
The nbf claim -> This is an improvement.
user_org claim -> We have to discuss and decide.

CC: @aaujayasena @nilasini @isharak