-
Fix Azure provider OIDC scope handling (#2506)
发布于
2025-12-01 18:42:36 +00:00 | 1447 次提交 在此版本后已推送到 main- Fix Azure provider to handle OIDC scopes correctly
OIDC scopes (openid, profile, email, offline_access) were being
incorrectly prefixed with identifier_uri, causing Azure to reject
authorization requests. This fix:- Detects OIDC scopes and sends them unprefixed to Azure
- Filters OIDC scopes from token validation (Azure doesn't include
them in access token scp claims) - Still advertises OIDC scopes to clients via valid_scopes
- Also handles dot-notation scopes (e.g., User.Read) correctly
-
Fix dot-notation scopes to be prefixed (custom scopes can have dots)
-
Improve Azure scope handling docs with clear examples
下载附件