enable adding custom scopes to access token#176
Open
DeemoONeill wants to merge 3 commits into
Open
Conversation
this adds scopes to "scopes supported" at the .wellknown endpoint it allows the user to requests these scopes it gates any non-openid spec scopes behind acl grants. so if a user is granted the custom:read scope but requests custom:write. they wouldn't be given it. Signed-off-by: Matthew O'Neill <moneill@lunarenergy.com>
Signed-off-by: Matthew O'Neill <moneill@lunarenergy.com>
Signed-off-by: Matthew O'Neill <moneill@lunarenergy.com>
DeemoONeill
force-pushed
the
feature/MO/add_additional_scopes
branch
from
3011e25 to
a7fcde4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These changes address one of the problems described in the following issue: #177
This enables users to set any additional scopes to be advertised at the
.well-known/oauth-authorization-serverend point.it also uses the scope key in the extraClaims to validate whether the user can be granted the scope.
This solves our particular usecase which is integrating with a 3rd party service that only uses the access token, and not the id token. But i'm happy to make, or for you to make, any changes required to make this appropriate for all users.
I apologise if the code isn't up to standard, i've not written much go and not for about a year, again, happy to make any changes to conform