发布

  • Fix Azure provider OIDC scope handling (#2506)

    frostbyte_neo 发布于 2025-12-01 18:42:36 +00:00 | 1447 次提交 在此版本后已推送到 main

    • Fix Azure provider to handle OIDC scopes correctly

    OIDC scopes (openid, profile, email, offline_access) were being
    incorrectly prefixed with identifier_uri, causing Azure to reject
    authorization requests. This fix:

    • Detects OIDC scopes and sends them unprefixed to Azure
    • Filters OIDC scopes from token validation (Azure doesn't include
      them in access token scp claims)
    • Still advertises OIDC scopes to clients via valid_scopes
    • Also handles dot-notation scopes (e.g., User.Read) correctly

    Fixes #2451, #2420

    • Fix dot-notation scopes to be prefixed (custom scopes can have dots)

    • Improve Azure scope handling docs with clear examples

    下载附件