title: Why is the IdentityTokenLifetime default to 300 sec?
body: <p>Maybe I should ask what the intended use of the Identity token is.   I thought it is used to identify the user and it can be passed to other services (e.g. backend services) and the that services use the id_token to validate it is a valid user?   But I don't see any current available endpoint to validate the id_token.  If not, what should be passed from one service to another service to validate the user?</p>
  
  <p>The only end point that takes the id_token parameter is the End Session Endpoint where it is passed as the id_token_hint.   But in that case, why is the IdentityTokenLifetime default to 300 sec only?   I don't expect the user end the session in 300 sec.</p>