After authentication to OAuth2 authorization server that supports OpenID using response_type=code with scope=openid email, calling token endpoint should return id_token.
What I am missing is whether this id_token should contain email or not - and client should in such case call userInfo endpoint.
The spec says:
http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
The Claims requested by the profile, email, address, and phone scope values are returned from the UserInfo Endpoint, as described in Section 5.3.2, when a response_type value is used that results in an Access Token being issued. However, when no Access Token is issued (which is the case for the response_type value id_token), the resulting Claims are returned in the ID Token.
To my understanding, this means that id_token does not need to contain email if access_token is available as userInfo should be called to get it. However looking at the implementation of oidc client in https://github.com/bitly/oauth2_proxy it seems they do require email claim to be available inside id_token without calling userInfo endpoint.
What is the correct behaviour in OpenID compliant authorization server?