When using OIDC Hybrid Flow, the nonce not passed when calling GrantTypeBase.add_id_token, despite it being present in request.nonce.

In the OIDC implicit flow, add_id_token is overridden to pull the nonce from request.nonce. In OIDC Authorization Code flow, we pull the nonce from the grant, but in Hybrid Flow nothing is done to handle the nonce, so it is omitted from the ID token. Putting the nonce in the ID token is REQUIRED for Hybrid Flow (3.3.2.11).

When retrieving the token from both the Authorization Endpoint and the Token Endpoint, the contents of the token should be the same - with some differences (3.3.3.6). The key phrase for me is All Claims about the Authentication event present in either SHOULD be present in both.

The nonce is a claim about the authentication event and must be present in the ID token returned from the authentication endpoint, so it should also be present in the id token from the token endpoint. This means that when handling a auth code token request in the hybrid flow, we should also be calling self.request_validator.get_authorization_code_nonce to retrieve any nonce from the grant.

EDIT: of course, when handling generating the ID token from the code, it doesn't matter that the code originally came from the hybrid flow, the token endpoint is handled by AuthorizationCodeGrant, which will inject the nonce just fine as long as it was correctly saved/restored along with the code.

How to reproduce

I'll add some tests to demonstrate.

Expected behavior

A nonce passed in to the authentication endpoint in hybrid flow should be present in the ID token from the authentication endpoint and the token endpoint.

Additional context

• Are you using OAuth1, OAuth2 or OIDC?
• OIDC
• Are you writing client or server side code?
• server side
• If client, what provider are you connecting to?
• N/A
• Are you using a downstream library, such as requests-oauthlib, django-oauth-toolkit, ...?
• Adding OIDC support to django-oauth-toolkit