Authorization request scope parameter optional

[tomheijmans]

I got an issue implementing the 'authorization code grant'-flow using IdentityServer4. The oauth spec marks the scope-parameter optional for the 'Authorization Request' as described here https://tools.ietf.org/html/rfc6749#section-4.1.1. Unfortunately IdentityServer4 doesn't support an optional scope-parameter for the authorization request. It will generate an error response 'Invalid scope'. I'm not able to add the scope parameter to the request because I'm not in control of the client which connects to my oauth server.

Are there any plans adding this feature to IdentityServer? Maybe I could create a pull request myself.

For reference: I found an older issue where the scope parameter is already marked optional for the token request. Default client scopes #161

[brockallen]

Put a middleware in front of IdentityServer to add it.

[tomheijmans]

@brockallen we already thought about this solution and this does work, but I don't think this is a nice solution. The middleware adds the 'scope' parameter to the querystring. Shouldn't the implementation be like it's done on the token exchange endpoint? Take the allowedscopes from the client if configured as the default.

[brockallen]

Well, our main focus is OIDC, which makes scope mandatory: :https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.