Skip to content

KEYCLOAK-14143 Turn OIDC requested scopes validation into an SPI#7721

Closed
reda-alaoui wants to merge 9 commits intokeycloak:mainfrom
Cosium:requested-scope-validation-spi
Closed

KEYCLOAK-14143 Turn OIDC requested scopes validation into an SPI#7721
reda-alaoui wants to merge 9 commits intokeycloak:mainfrom
Cosium:requested-scope-validation-spi

Conversation

@reda-alaoui
Copy link
Contributor

@reda-alaoui reda-alaoui commented Jan 15, 2021

Fix #8751

This change turns OIDC requested scopes validation into an SPI.

@reda-alaoui reda-alaoui changed the title KEYCLOAK-14143 Config option for validation of requested scopes KEYCLOAK-14143 Turn OIDC requested scopes validation into an SPI Jan 15, 2021
@reda-alaoui
Copy link
Contributor Author

reda-alaoui commented Jan 15, 2021

CI says ClientInvalidationClusterTest is failing.

However, this test is green on my computer when running:

 mvn -f testsuite/integration-arquillian/pom.xml clean install \
    -Pauth-server-cluster-quarkus \
    -Dsession.cache.owners=2 \
    -Dtest=ClientInvalidationClusterTest

@reda-alaoui
Copy link
Contributor Author

Also green on my computer with:

mvn -f testsuite/integration-arquillian/pom.xml clean install     -Pauth-server-cluster-quarkus     -Dsession.cache.owners=2 -Dtest=**.cluster.**

@reda-alaoui reda-alaoui force-pushed the requested-scope-validation-spi branch from 1f0c8fa to 1a458de Compare February 2, 2021 09:51
PiryazevAlex
PiryazevAlex previously approved these changes Mar 18, 2021
borukho
borukho previously approved these changes Mar 18, 2021
@stianst stianst added the status/needs-discussion PR needs discussion on developer mailing list label Jun 4, 2021
@stianst
Copy link
Contributor

stianst commented Jun 4, 2021

I appreciate the current behaviour is not great, but not sure we should require custom providers to be more flexible. Can we have a discussion on the dev mailing list around this topic?

@leandrobortoli
Copy link
Contributor

A discussion has been started on the dev mailing here. I would greatly appreciate it if this topic gained more attention as we also have a technical impediment regarding dynamic scopes.

# Conflicts:
#	services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java
@mposolda
Copy link
Contributor

@reda-alaoui @PiryazevAlex @borukho Thanks for the contribution and feedback! I am closing this PR sincewe took a bit different approach after all and in recent Keycloak version (Keycloak 17), there is new feature of parameterized/dynamic scopes, which is supposed to handle use-cases like this. You will need to enable feature "dynamic_scopes" and when you do it, there is new field when creating client scope, which allows to setup this client scope as dynamic. So for example having dynamic scope like "foo" will allow that KEycloak would understand all the scopes like "foo:bar" or "foo:something-else" .

The feature is still being developed by @dgozalo , so feedback is welcome if the current Keycloak does not support your requested use-cases. In that case, feel free to create new issue in the GH and describe your use-case and possibly tag Daniel and/or me in the GH issue

@mposolda mposolda closed this Feb 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status/needs-discussion PR needs discussion on developer mailing list

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Config option for validation of requested scopes

6 participants