CAS5 OIDC support hybrid flow?

[Yan Zhou]

Hi there,

CAS 5.3.x.   oidc flow.

it works well with authorization code flow.  does it support "hybrid flow", i.e., the response type is "code token" or "code id_token".

I am getting "application not authorized to use CAS" error.

Is this by design?

2021-03-07 04:40:24,173 WARN [org.apereo.cas.support.oauth.web.endpoints.OAuth20AuthorizeEndpointController] - <Ignoring malformed request [https://localhost:8543/cas5/oidc/authorize?client_id=demoOIDC&redirect_uri=https%3A%2F%2Foidcdebugger.com%2Fdebug&scope=openid&response_type=code%20token&response_mode=form_post&nonce=bq50c2y1iy] no OAuth20 validator could declare support for its syntax>

2021-03-07 04:40:24,174 ERROR [org.apereo.cas.support.oauth.web.endpoints.OAuth20AuthorizeEndpointController] - <Authorize request verification failed. Either the authorization request is missing required parameters, or the request is not authenticated and contains no authenticated profile/principal.>

Thanks!