CODEWITHSUNDEEP
spring-securityoauth-2.0azure-active-directorykeycloakopenid-connect
JangoCG
JangoCG

Reputation: 976

How to Obtain Custom-Scope Token When /userinfo Also Requires openid

I'm using Spring Cloud API Gateway with OAuth2 and I'm facing an issue while trying to acquire an access token for a custom scope. My OAuth2 provider is Microsoft.

I need the access token to authenticate against my custom APIs, which require a custom scope. However, I've noticed that the /userinfo endpoint also needs to be called, and it requires an openid scope.

If I include both the openid and custom scopes, the request gets denied. If I exclude the openid, the call to /userinfo fails due to "insufficient scope".

So, how can I obtain an access token for my custom-scope API without affecting the /userinfo endpoint call?

# Spring Cloud API Gateway OAuth2 client settings
spring:
  security:
    oauth2:
      client:
        registration:
          my-client:
            provider: microsoft
            client-id: xxx
            client-secret: xxx
            authorization-grant-type: authorization_code
            redirect-uri: http://localhost:8080/login/oauth2/code/your-client
            scope: custom-scope # Can't add 'openid' here without the request failing

Upvotes: 1

Views: 224

Answers (1)

Gary Archer
Gary Archer

Reputation: 29218

This behavior specific to Azure AD. Your best bet is for the client to use only custom scopes. Then get user info via an API that exchanges the access token for one with rights to call the Graph API, using the On Behalf Of Flow. For more info see these resources of mine:

Upvotes: 0

Related Questions