SimonLinder commented on issue #3398: NIFI-6171 always send email scope for OIDC URL: https://github.com/apache/nifi/pull/3398#issuecomment-481123464 @mcgilman Yes, with this fix in place, I could work against my IDP. I further investigated the issue. So first of all, [here](https://auth0.com/docs/scopes/current/oidc-scopes) you can find the explanation about my observation concerning the call to the userinfo endpoint: Once the user authorizes the requested scopes, the claims are returned in an ID Token and are also available through the /userinfo endpoint. So the **email** scope is only available via the userinfo endpoint if it was requested previously. So this would confirm my suggestion to remove the lookEmail() function; beside the work-around for #NIFI-4698. You're right about the required scope. Only the **openid** scope is required to be sent when requesting the token. But NiFi is highly dependent on the existence of the email value. Otherwise NiFi could not verify the user that wants to log in. So what would happen if the user requests the **email** scope and the IDP won't support it? If the request really throws an exception or simply doesn't return the email value? An exception is caught by the try-catch block, an empty email value would lead to a request to the userinfo endpoint, that probably will also have no result, thus the user cannot login to NiFi (using this IDP). So the selected IDP might be not the correct choice.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
