OpenID Connect sub claim should be consistent
Currently the access token and id token that are issued have different "sub" claims even though the token request is for the same application registration...and the same request. This doesn't seem to match with the documentation and seems wrong. Can this be fixed please?
Stephen
shared this idea
1 comment
-
Stephen
commented
Compare the description of "sub" for id_token vs access_token. They should be the same but you'll find they are different following an 'authorization code grant flow" https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow with scope "openid" requested.
id_token: https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#payload-claims
access_token: https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens#payload-claims