Docs are confusing regarding oic package

[TecIntelli]

Hello project team,

thanks for your effort providing this new OIDC library, great job. I have read you docs with interest and have learned more about OIDC and your project goals.

However, I am little bit confused concerning your statement about django-allauth. There you write ...is based on the python package oic which we believe should not be used for OIDC usages. But the django-allauth package doesn't have the mentioned oic package in there requirements. Instead I found the oic package in the dependencies of your package.

Could you brielfy explain what package django-allauth is using for OIDC and why this should not be used for OIDC usages, from your perspective?

Cheers

[gbip]

You are right, this is a mistake. I looked at the git history for this package and they do not seem to have used oic at any point in the last year. I don't know why we wrote this sentence, maybe we mixed some OIDC packages analysis at some point ?

I don't have the time to investigate it a lot, but they are using python3-openid. From it's name I would say that it is not an OpenID Connect implementation, but making such a statement would require to analyze this library.