Post #2630831

@heiglandreas@phpc.social The mental model for OIDC is: "Who authenticated the user?" You still must answer: "Why do I trust this OP for this organization/domain?" This is an application trust/onboarding problem, not an authentication protocol problem.