F.4.2 Authentication by Using the Implicit Flow

In this authentication process, the authorization endpoint returns all tokens. The endpoint returns the Access token and ID token directly to the client application that may result in revealing the tokens to the user and applications that have access to the User Agent.

Process Flow:

  1. The client application generates an authentication request containing the desired request parameters and sends the request to the authorization server.

  2. The authorization server authenticates the user.

  3. The authorization server obtains the user consent.

  4. The authorization server sends the user to the client application with an ID token and, if requested, an Access token.

  5. The client application validates the ID token and retrieves the user's Subject Identifier.