OpenID Connect support with security features

We are currently using API Connect Version 5.0.8 and use the developer portal with portal delegated user registry. T-his enabled us to use custom modules to use OpenID Connect in combination with our own OpenID Identity Provider. We do not want/need users to register directly in the developer portal, but use existing OpenID Identitites.

API Connect Version 2018.1 does not support the use portal delegated user registry and the use of OpenID Connect to log in with our Identity Porvider (and customize the openid flow).

We need API Connect to support Login Openid / Social Login in a secure mannerm which must include these features:
- OpenID Connect Hybrid flow
- response_mode=codce+id_token (Other response_mode values described for the Hybrid Flow in the OpenID Conenct Core specification dfo not matter for us, but may be relevant for other users)
- c_hash in signed id_token of the authorization request should be checked against hash of the auth. Code (prevent code manipulation, MITM): OpenID Core Spec 3.3.2.11
- at_hash in signed id_token of the token service request should be checked against the hash of the access token (prevent token manipulation, MITM): OpenID Core Spec 3.3.2.11
- Use of the parameter „nonce“ to bind id_token to a session and prevent replay attacks: OpenID Core Spec 3.3.2.11 (nonce should be at least 20 character in length)
- Support of PKCE (Proof Key for Code Exchange, RFC 7636, to prevent code interception attacks)
- Use of the parameters state to prevent CSRF attacks (state should be at least 20 character in length)
- Scope of the Open ID Connect authentication must be configurable: like „openid email profile customscope123 another_scope“
- End user Identity should then be extracted from a custom claim (example: person_id) in the UserInfo-Endpoint Response of our OpenID Identity Provider