Repository navigation
Clarification on the full scope allowed switch #20006
|
Hello, It’s not very clear in my mind what the “full scope allowed” switch in the client dedicated scopes settings does. When ON, and the user has the |
Replies: 3 comments 4 replies
|
The switch allows to create access tokens with only a subset of the user's roles. You probably want to set it to "off" and configure all roles which are actually needed by the client. |
|
Maybe also see this discussion: #19869, section: "Dedicated client scope and "Full scope allowed" setting" |
|
@xianli123 perhaps we can improve the copy for this? |
|
Thanks for your answer @jbman. I’m not an OAuth2/OpenID Connect expert, but, although this default “Full scope allowed” setting seems appropriate for an ecosystem where a single frontend application can make API calls to multiple trusted backend services on behalf of the user, it seems pretty insecure in presence of untrusted applications (like explained in the documentation). Maybe it should be clarified why this is the default setting and it should be emphasized that it’s strongly advised to change this setting (or maybe I missed some point here)? |
|
I agree that it would be much better to have secure by default settings. However it is hard to change existing defaults without breaking things. My proposal is a tab named "Delegated Roles". Ar text should explains that you need to add some roles here, in order to delegate then to the client in the access token. If "full scope allowed" is switched off, it should also be stated that no roles will be put into the access token. |
The switch allows to create access tokens with only a subset of the user's roles. You probably want to set it to "off" and configure all roles which are actually needed by the client.
And yes, if the
manage-account-roleis in the token it can be used at the account API for user-self-service operations. So if your client doesn't do sth. with this you can achieve a token with less privileges if you switch "Full scope allowed" to "off" and configure needed roles.