title: OpenID Connect Standard: Authorized Party azp Contradiction
body: <p>In the <a href="http://openid.net/specs/openid-connect-core-1_0.html" rel="noreferrer">OpenID Connect spec</a> the azp (authorized party) claim seems to have a contradiction.</p>
  <p>In the ID token definition section <a href="http://openid.net/specs/openid-connect-core-1_0.html#IDToken" rel="noreferrer">2</a> it says:</p>
  <blockquote>
  <p><strong>azp</strong></p>
  <p>OPTIONAL. Authorized party - the party to which the ID Token was issued. If present, it MUST contain the OAuth 2.0 Client ID of this party. <em>This Claim is only needed when the ID Token has a single audience value and that audience is different than the authorized party</em>. It MAY be included even when the authorized party is the same as the sole audience...</p>
  </blockquote>
  <p>But in token validation section <a href="http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation" rel="noreferrer">3.1.3.7</a>, one of the steps seems to say the opposite:</p>
  <blockquote>
  <ol start="4">
  <li>If the ID Token contains multiple audiences, the Client SHOULD verify that an azp Claim is present.</li>
  </ol>
  </blockquote>
  <p>Could anyone shed some light on this apparent discrepancy? Only the second instance uses declaratory language, so I'm leaning towards favoring that in my implementation.</p>