Repository navigation
Clarify the required OIDC scopes (profile or webid) #29
Description
The only mention oidc scope in the draft is in an example for the app WebID client registration: https://solid.github.io/authentication-panel/solid-oidc/#clientids-webid.
It lists openid profile offline_access. If my memory serves me correctly, this used to be openid profile offline_access where webid was a required scope to trigger the solid-oidc process.
Is this now profile? If so, there should be normative language stating so.
Activity
acoburn commentedon Oct 23, 2020
I don't believe there is any new scope defined in this spec.
jaxoncreed commentedon Oct 26, 2020
I don't think
profilemakes sense for a scope, as that scope is usually to go an email and name, none of which is included in our token claim. Also, would it make sense to have a scope to get the webid claim? We used to have thewebidscope.elf-pavlik commentedon Oct 26, 2020
Looking at https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
It seems reasonable to have
webidscope if clients expects to getwebidclaim in the id token. Maybe even it would make sensesolidscope to get solid access token.matthieubosquet commentedon Mar 8, 2021
Mentioned in discussions on solid/authentication-panel#141 via auth panel https://hackmd.io/tI_WdIvVSd2AaMBWt0D3_Q
I would +1
solidscope rather thanwebidsince it seems consistent with the access token's audience claim.Note: Adding scope will require a bit of work on the client side.
acoburn commentedon Mar 8, 2021
I could go either way between
solidandwebid(with a slight preference forsolid). Requiring a scope would provide a clear mechanism for clients to signal that they want asolidaccess token.Overall, +1 on using a scope for this.
matthieubosquet commentedon Jul 23, 2021
Can/should we transfer https://github.com/solid/authentication-panel/issues/86 & https://github.com/solid/authentication-panel/issues/146 to https://github.com/solid/solid-oidc?
I think the
solidscope matched with asolidclaim does make sense.I couldn't pinpoint where the requirement is clearly expressed in the spec with a "MUST", but it seems to me that missing it is problematic.
acoburn commentedon Jul 23, 2021
Yes we can start transferring these issues
acoburn commentedon Oct 4, 2021
This was discussed during the Sept 27, 2021 meeting, and it was resolved to require the
webidscope for interactions where thewebidclaim is provided in access/ID tokens.A related PR is forthcoming
Add requirement for webid scope
Add requirement for webid scope