id_token/Identity token claims difference between implicit vs any other flow

Question

Why there is a difference in identity token claims when using implicit or any other grant type? Is this by specification or am I doing something wrong? Any help to understand this behavior will be highly appreciated.

When I use implicit grant type with id_token response, I get all the claims added into the scope from client that identity server is protecting. But when I use hybrid grant type or code grant type, most of the claims (email and phone) are missing from Identity token. But I can see email and phone in scope list with in access token. Using access token I can hit userinfo endpoint to get all the info in scope.

Answer 1

Depending on the flow used and the identity provider implementation, the content of the tokens may vary.

The OpendId Connect Specs say:

3.3.3.6. ID Token

When using the Hybrid Flow, the contents of an ID Token returned from the Token Endpoint are the same as for an ID Token returned from the Authorization Endpoint, as defined in Section 3.3.2.11, with the exception of the differences specified in this section.

If an ID Token is returned from both the Authorization Endpoint and from the Token Endpoint, which is the case for the response_type values code id_token and code id_token token, the iss and sub Claim Values MUST be identical in both ID Tokens. All Claims about the Authentication event present in either SHOULD be present in both. If either ID Token contains Claims about the End-User, any that are present in both SHOULD have the same values in both. Note that the OP MAY choose to return fewer Claims about the End-User from the Authorization Endpoint, for instance, for privacy reasons. The at_hash and c_hash Claims MAY be omitted from the ID Token returned from the Token Endpoint even when these Claims are present in the ID Token returned from the Authorization Endpoint, because the ID Token and Access Token values returned from the Token Endpoint are already cryptographically bound together by the TLS encryption performed by the Token Endpoint.

And if you get the Access Token from both endpoints (Authorize and Token) they can be different:

3.3.3.8. Access Token

If an Access Token is returned from both the Authorization Endpoint and from the Token Endpoint, which is the case for the response_type values code token and code id_token token, their values MAY be the same or they MAY be different. Note that different Access Tokens might be returned be due to the different security characteristics of the two endpoints and the lifetimes and the access to resources granted by them might also be different.