Default client scopes

[JonCubed]

I'm porting our custom oauth implementation to identity server 4. Currently all our services have their own list of clients, I would like to merge them all into identity server instead with scopes. Currently third-parties are not sending the scope header, however in identity server 4 this returns a bad request with "invalid_scope".

I've looked at the code and it does not look like this scenario is possible. Would it be possible to be able to specify default scopes for a client so if the scope header is not present it will not fail?

From my understanding of the spec a predefined list of default scopes is allowed if the scope header is missing.

[leastprivilege]

We have no plans right now to change that. Tbh - there are other priorities right now to be able to ship 1.0

But I added this as a feature request.

[JonCubed]

ok, any chance you'd be open to pull request to add this before 1.0?

[leastprivilege]

we will discuss it.

[JonCubed]

thanks @leastprivilege

[brockallen]

Perhaps if scopes are absent, we just use the list of configured allowed scopes...

[brockallen]

@JonCubed What flows are your third parties using?

[JonCubed]

@brockallen they are using Client Credentials

[leastprivilege]

OK - I'll add that feature for client credentials.

[leastprivilege]

see here

#241

does that work for you?

[JonCubed]

@brockallen yes it does, thank you very much for getting done so quickly

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.