Why is the client_metadata_endpoint required in the config response?

[togamid]

Currently, client_metadata_endpoint is a required field of the response of the config endpoint . However, an empty object is a valid response to this endpoint (definition here) and chromium even silently ignores a 404 response (the spec doesn't specify specific behavior for this case).

Why is client_metadata a required field if the IdP technically doesn't even need to implement an actual endpoint to get a working IdP?

[npm1]

Yea, this is a fair point. In practice we are treating the client metadata endpoint as optional. I think we could change the spec to make it so.