title: Why Client Secret is required for OIDC unlike SAML?
body: <p>I have a fair understanding of bot SAML and OAuth2/OIDC. In case of SAML, IdP posts SAML assertion after authentication. I'm wondering why not take the same approach for OIDC as well? In case of OIDC, after the authentication, IdP could post ID token and Access token. This would simplify the flow.</p>
  <p>If the IdP needs to validate the client (RP), the request can be signed similar to SAML.</p>