From e4b6df3f27008c35feae0bcd1b9cc0b8cd90b52d Mon Sep 17 00:00:00 2001 From: "Jens L." Date: Mon, 3 Feb 2025 15:29:26 +0100 Subject: [PATCH] providers/oauth2: include scope in token response (#12921) * fix scope param missing from token response Signed-off-by: Jens Langhammer * fix Signed-off-by: Jens Langhammer # Conflicts: # authentik/enterprise/providers/ssf/signals.py # authentik/enterprise/providers/ssf/tasks.py # authentik/enterprise/providers/ssf/tests/test_stream.py --------- Signed-off-by: Jens Langhammer --- authentik/providers/oauth2/tests/test_token.py | 3 +++ authentik/providers/oauth2/views/token.py | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/authentik/providers/oauth2/tests/test_token.py b/authentik/providers/oauth2/tests/test_token.py index c2e897182a..2ddcc76e4d 100644 --- a/authentik/providers/oauth2/tests/test_token.py +++ b/authentik/providers/oauth2/tests/test_token.py @@ -150,6 +150,7 @@ class TestToken(OAuthTestCase): "id_token": provider.encode( access.id_token.to_dict(), ), + "scope": "", }, ) self.validate_jwt(access, provider) @@ -242,6 +243,7 @@ class TestToken(OAuthTestCase): "id_token": provider.encode( access.id_token.to_dict(), ), + "scope": "offline_access", }, ) self.validate_jwt(access, provider) @@ -301,6 +303,7 @@ class TestToken(OAuthTestCase): "id_token": provider.encode( access.id_token.to_dict(), ), + "scope": "offline_access", }, ) diff --git a/authentik/providers/oauth2/views/token.py b/authentik/providers/oauth2/views/token.py index 9ee25dd555..ba8d571d88 100644 --- a/authentik/providers/oauth2/views/token.py +++ b/authentik/providers/oauth2/views/token.py @@ -627,6 +627,7 @@ class TokenView(View): response = { "access_token": access_token.token, "token_type": TOKEN_TYPE, + "scope": " ".join(access_token.scope), "expires_in": int( timedelta_from_string(self.provider.access_token_validity).total_seconds() ), @@ -710,6 +711,7 @@ class TokenView(View): "access_token": access_token.token, "refresh_token": refresh_token.token, "token_type": TOKEN_TYPE, + "scope": " ".join(access_token.scope), "expires_in": int( timedelta_from_string(self.provider.access_token_validity).total_seconds() ), @@ -736,6 +738,7 @@ class TokenView(View): return { "access_token": access_token.token, "token_type": TOKEN_TYPE, + "scope": " ".join(access_token.scope), "expires_in": int( timedelta_from_string(self.provider.access_token_validity).total_seconds() ), @@ -767,6 +770,7 @@ class TokenView(View): response = { "access_token": access_token.token, "token_type": TOKEN_TYPE, + "scope": " ".join(access_token.scope), "expires_in": int( timedelta_from_string(self.provider.access_token_validity).total_seconds() ),