Is "scope" a standard claim?

user_2470524 0
Viewed 3481

Is there any standard scope claim in OpenID Connect, JWT or OAuth?

In the IdentityServer 4 documentation, the there is a "scope" which is a space-separated string.

{
  "client_id": "mobile_app",
  "sub": "123",
  "scope": "read write delete"
}

But from my IdentityServer 4 instance, I get a "scope" claim in the access token which is a array of strings.

{
  // ...
  "client_id": "mobile_app",
  "sub": "123",
  "scope": [ "openid", "profile", "email", "offline_access" ],
  "amr": [ "pwd" ]
}

In the OpenID Connect Core 1.0 specification, I do not see "scope" listed as a claim. In the RFC 7519 JSON Web Token (JWT) specification, I do not see "scope" listed as a claim.

identityserver4 jwt openid-connect
2 Answers

The scope claim was standardized by the Token Exchange RFC. According to the spec it should be a JSON string, with a space-separated scope tokens.

The value of the "scope" claim is a JSON string containing a space-separated list of scopes associated with the token...

user_17122940

Most providers supports the AT+JWT token type and in it is specified that it should include a scope claim:

It says:

If an authorization request includes a scope parameter, the corresponding issued JWT access token MUST include a scope claim as defined in section 4.2 of [TokenExchange].

All the individual scopes strings in the scope claim MUST have meaning for the resource indicated in the aud claim.

Andy_684900
Related