Repository navigation
Keycloak does not honour scope parameter in the refresh flow #12140
cgeorgilakis
started this conversation in
Ideas
Replies: 1 comment
|
Could you review the PR in order Keycloak being compliant with OAuth2 specification? As you can see in Auth2 specification :
|
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Although request flow is implemented in Keycloak, Keycloak does not take into account scope parameter.
According to Section 6 in OAuth2 RFC:
Moreover, according to Section 6 in OAuth2 RFC:
As you can see from documentation scope parameter is optional to put from a user but mandatory to support for refresh flow process. Keycloak MUST support scope parameter in refresh flow.
I have put a github with a related PR. After it, I have observed that another github issue has been created for it. However, nothing has been done for implementing it.
Could you review the PR in order Keycloak being compliant with OAuth2 specification?
Taking into account this change, it is important that UserInfo endpoint response is restricted based on Access Token scopes. For example access token produced by refresh flow with scope parameter. I have implemented it by filtering default Client scopes based on access token scope. If you have another idea , we could discuss it.
All reactions