This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
OpenID Connect Scopes
OpenID Connect Scopes

Version management

Difference between version and

At line 1 added 48 lines
!!! Overview
[OpenID Connect] [OAuth Clients] use [OAuth Scope] values, as defined in [OAuth 2.0] [RFC 6749], to specify what access [Privileges] are being requested for [Access Tokens].
The scopes associated with [Access Tokens] determine what resources will be available when they are used to access [OAuth 2.0] protected endpoints. Protected Resource endpoints __MAY__ perform different actions and return different information based on the scope values and other parameters used when requesting the presented [Access Token].
For [OpenID Connect], scopes can be used to request that specific sets of information be made available as Claim Values.
Claims requested by the following scopes are treated by Authorization Servers as [Voluntary Claims|OpenID Connect Claims].
[OpenID Connect] defines the following [{$pagename}] values:
* [openid|Openid scope] - [REQUIRED] - Informs the [Authorization Server] that the Client is making an [OpenID Connect] request. If the openid scope value is not present, the behavior is entirely unspecified. The [Openid scope] does not define any [Claims] will be returned.
* [profile] - [OPTIONAL] - This [{$pagename}] value requests access to the End-User's [Default Profile Claims]
* [email] - [OPTIONAL] - This [{$pagename}] value requests access to the [email] and [email_verified] [Claims].
* [address] - [OPTIONAL] - This [{$pagename}] value requests access to the [address] [Claim].
* [phone] - [OPTIONAL] - This [{$pagename}] value requests access to the [phone_number] and [phone_number_verified] [Claims].
* [offline_access] - [OPTIONAL] - This scope value requests that an [OAuth 2.0] [Refresh Token] be issued that can be used to obtain an [Access Token] that grants access to the End-User's [Userinfo_endpoint] even when the End-User is not present (not logged in).
Multiple [{$pagename}] values [MAY] be used by creating a space-delimited, case-sensitive list of [ASCII] [{$pagename}] values.
The [Claims] requested by the [profile], [email], [address], and [phone] scope values are returned from the [Userinfo_endpoint], as described in Section 2.3.2.
The Claims requested by the profile, email, address, and phone scope values are returned from the [Userinfo_endpoint], as described in Section 5.3.2 of [OAuth 2.0] [RFC 6749], when a response_type value is used that results in an [Access Token] being issued. However, when no [Access Token] is issued (which is the case for the response_type value id_token), the resulting Claims are returned in the [Identity Token].
!! [Standard Claims|OpenID Connect Claims]
[OpenID Connect] has defined some [Standard Claims|OpenID Connect Claims].
!! Discovery
The [Openid-configuration] [Endpoint] for the [Authorization Server] provides a list of "[scopes_supported]". The [OAuth Client] can query the [Openid-configuration] [Endpoint] and obtain this list and then query the [Userinfo_endpoint] to obtain values for the [Entity] within the [Identity Token].
The [{$pagename}] that the [OAuth Client] requested are __OPTIONALLY__ presented in a UI with wording similar to: "Do you authorize them to do this on your behalf". The [OAuth Client] may request certain rights, but the [Resource Owner] may only grant some of them or allow others that are not even requested. Such a page may not be presented to the [Resource Owner], however as when the [Resource Owner] has already granted the client such rights by way of a EULA, employment contract, etc. and this page maybe skipped.
What is in the [{$pagename}], how you use them, how they are displayed or not displayed, and pretty much everything else to do with scopes are not defined by the [OAuth] spec. They may be specified within [User Managed Access|User-Managed Access] profiles or [OpenID Connect] does define a few [{$pagename}].
In some cases, the End-User will be given the option to have the OpenID Provider decline to provide some or all information requested by [Relying Party]. To minimize the amount of information that the End-User is being asked to disclose, an [Relying Party] can elect to only request a subset of the information available from the [Userinfo_endpoint].
!! [Example] [{$pagename}] Request
The following is a non-normative example of an unencoded scope request:
%%prettify
{{{
scope=openid profile email phone
}}} /%
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop