mcgilman commented on issue #3398: NIFI-6171 always send email scope for OIDC URL: https://github.com/apache/nifi/pull/3398#issuecomment-481799434 @SimonLinder Thanks for updating your branch. I just tried the PR against the mitreid-connect IdP [1] and it is exhibiting the same behavior that I recall seeing during the initial development of this capability. The token request that we perform to get the id and access token return successfully. However, despite the presence of the `email` scope the id token does not necessarily contain the claims that correspond to the authorized scopes. It does, however, as you pointed out, make those claims available via subsequent calls to the UserInfo endpoint. Looking at the spec for the id token [2] it appears that the id token may contain additional claims. I think that is what we're seeing with the Google Idp and possibly the implementation you're using. I think we need to retain the `lookupEmail` method to restore the capabilities for implementations that do not include additional claims in the token response. I propose the following: 1) Always include both `openid` and `email` scopes. 2) Remove unnecessary checks for scopes in the constructor. 3) Retain `lookupEmail` for invoking the UserInfo endpoint. I'd also like to get your opinion on optionally introducing the following: 4) Add a property to `nifi.properties` to allow the nifi admin to configure additional scopes (e.g. `profile`). These would be included in addition to `openid` and `email`. 5) Add a property to `nifi.properties` to allow the nifi admin to configure the claim that we should use to identify the user. This would allow folks to configure any claim to identify the user and not be dependent on `email`. This property would default to `email` to retain backward compatibility. However, the nifi admin could ultimately choose any claim as long as it was available through the configured scopes. These changes should be pretty straight forward and I am happy to review if you're interested in contributing them too. If not, I can file follow on JIRAs for these improvements. [1] https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server [2] https://openid.net/specs/openid-connect-core-1_0.html#IDToken
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
