When using AddOpenIdConnect, why are default Scopes added?

Viewed 1153

I am trying to set-up an OpenIdConnect within my Startup.cs class of my .NET Core project but I keep being presented with the error:

Message contains error: 'invalid_scope', error_description: 'error_description is null', error_uri: 'error_uri is null'.

I guess the reason for this error is because during my code shown below, I clear the o.Scope list because it seems to contain 2 default scopes:

  1. openid
  2. profile

If I do NOT clear the default scopes, the client I am accessing is unable to recognise my request against a valid application, and therefore my request fails at their side. In this case, I do re-add the scope: "openid" which allows me to make a successful request to my client, but then on the redirection to my RedirectUri I am getting the error mentioned above.

  • Is the "invalid_scope" error coming from my client? Or is this occurring within the Middleware using by .NET Core?

  • Should I ask the client to update the scopes at their side to include "profile" so I don't have to clear the default scopes?

                        services.AddAuthentication().AddOpenIdConnect(socialProvider.ProviderName, o =>
                            {
                                o.ClientId = "xx"
                                o.ClientSecret = "xx"
                                o.Authority = "xx"
                                o.CallbackPath = "xx"

                                // There appear to be 2 scopes added by default here that cause the 
                                // integration for o to not be recognised as an application when we get to o' side.
                                o.Scope.Clear();
                                o.Scope.Add("openid");

                                o.GetClaimsFromUserInfoEndpoint = true;
                                o.SaveTokens = true;
                                o.RequireHttpsMetadata = false;

                            });

1 Answers

AddOpenIdConnect does auto create the OpenIdConnectOptions object, and the default scope is openid and profile. So you should either tell your identity to support both of these scopes or clear our the default scope and add whatever the client is supported

Related