If the End-User identified by the Identity Token is Logged in or is logged in by the request, then the Authorization Server returns a positive response; otherwise, it SHOULD return an error.
When possible, an Id_token_hint SHOULD be present when prompt=none is used and an Invalid_request OAuth Error MAY be returned if it is not; however, the server SHOULD respond successfully when possible, even if it is not present. The Authorization Server need not be listed as an audience of the Identity Token when it is used as an Id_token_hint value.