Does OpenID Connect Hybrid Flow return ID Token on /token endpoint?

Question

In OpenID Connect, there is a flow called "hybrid flow". The hybrid flow returns, depending on the response_type (e.g. id_token code, id_token code token), the ID token immediately. My question wether the /token endpoint should return an ID token even if an ID token was already issued by the /authorize endpoint (e.g. when response_type is id_token code).

I would also like to know if an ID token is returned by the /token endpoint when response type is code token and the scope contains openid.

The specs don't really give much information on this matter (or I'm looking at the wrong sections): http://openid.net/specs/openid-connect-core-1_0.html#HybridTokenEndpoint

Answer 1

Chapter 3.3.3.6 of openid-connect-core-1_0 specification you are linking:

When using the Hybrid Flow, the contents of an ID Token returned from the Token Endpoint are the same as for an ID Token returned from the Authorization Endpoint, as defined in Section 3.3.2.11, with the exception of the differences specified in this section.

If an ID Token is returned from both the Authorization Endpoint and from the Token Endpoint, which is the case for the response_type values code id_token and code id_token token, the iss and sub Claim Values MUST be identical in both ID Tokens. All Claims about the Authentication event present in either SHOULD be present in both. If either ID Token contains Claims about the End-User, any that are present in both SHOULD have the same values in both. Note that the OP MAY choose to return fewer Claims about the End-User from the Authorization Endpoint, for instance, for privacy reasons. The at_hash and c_hash Claims MAY be omitted from the ID Token returned from the Token Endpoint even when these Claims are present in the ID Token returned from the Authorization Endpoint, because the ID Token and Access Token values returned from the Token Endpoint are already cryptographically bound together by the TLS encryption performed by the Token Endpoint.

My interpretation would be that, yes, /token endpoint does return ID Token if "id_token" response type has been originally requested.