Wellknown overriding supplied scopes given in config

[DarkKlaw]

Just tried EasyOIDC to add OIDC support for a nicegui app I am prototyping.
It was quite easy to get started. I however encountered a weird issue of receiving a bad scope error when I was supplying the right scopes in the config.

After digging, we noticed that this line (

EasyOIDC/EasyOIDC/config.py

Line 114 in bbe0d67

self.scope = data['scopes_supported']

) was overriding the scope given in the config. This is a problem for my context since our keycloak instance has a lot of clients and groups and not all clients require all scopes by design.

As a solution, I suggest using the wellknown to verify the config scopes are correct rather than using them to override the value. However, I could have misunderstood the use of supplying the wellknown endpoint in the config.

[jpmanson]

Hi @DarkKlaw !

Thanks for your feedback.

You're right. The "wellknow" URL gives us the supported scopes, but that does not mean that we should implement all of them in the client. It is correct that the library should not copy that parameter and overwrite the local configuration.

We could do the following:

1. If self.scope is not defined, then copy scopes_supported from the server (as currently done).
2. If self.scope is defined, validate that each scope value is supported as indicated by the server in scopes_supported. For example, if the client has the scope "openid,profile,email,roles" and the server supports "openid,profile,email", then raise an error.

Any suggestions on this?
Bye!

[jpmanson]

I've implemented the new behaviour in v0.1.8

[DarkKlaw]

Hi @DarkKlaw !

Thanks for your feedback.

You're right. The "wellknow" URL gives us the supported scopes, but that does not mean that we should implement all of them in the client. It is correct that the library should not copy that parameter and overwrite the local configuration.

We could do the following:

1. If `self.scope` is not defined, then copy scopes_supported from the server (as currently done).

2. If `self.scope` is defined, validate that each scope value is supported as indicated by the server in scopes_supported. For example, if the client has the scope `"openid,profile,email,roles"` and the server supports `"openid,profile,email"`, then raise an error.

Any suggestions on this? Bye!

Sorry for the late reply. This was what I was thinking as well.