KEYCLOAK-14143 Turn OIDC requested scopes validation into an SPI#7721
KEYCLOAK-14143 Turn OIDC requested scopes validation into an SPI#7721reda-alaoui wants to merge 9 commits intokeycloak:mainfrom
Conversation
|
CI says However, this test is green on my computer when running: |
|
Also green on my computer with: |
1f0c8fa to
1a458de
Compare
|
I appreciate the current behaviour is not great, but not sure we should require custom providers to be more flexible. Can we have a discussion on the dev mailing list around this topic? |
|
A discussion has been started on the dev mailing here. I would greatly appreciate it if this topic gained more attention as we also have a technical impediment regarding dynamic scopes. |
# Conflicts: # services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java
126236f
|
@reda-alaoui @PiryazevAlex @borukho Thanks for the contribution and feedback! I am closing this PR sincewe took a bit different approach after all and in recent Keycloak version (Keycloak 17), there is new feature of parameterized/dynamic scopes, which is supposed to handle use-cases like this. You will need to enable feature "dynamic_scopes" and when you do it, there is new field when creating client scope, which allows to setup this client scope as dynamic. So for example having dynamic scope like "foo" will allow that KEycloak would understand all the scopes like "foo:bar" or "foo:something-else" . The feature is still being developed by @dgozalo , so feedback is welcome if the current Keycloak does not support your requested use-cases. In that case, feel free to create new issue in the GH and describe your use-case and possibly tag Daniel and/or me in the GH issue |
Fix #8751
This change turns OIDC requested scopes validation into an SPI.