required_scope of authenticator validate only scope claim and not scp claim about oathkeeper HOT 7 CLOSED

Yeah, the scope field should be configurable in oathkeeper. This is the second time this came up!

from oathkeeper.

Was going to prepare a PR about this (and already modified line 132 for internal use). According to the RFC and in practice multiple IdP such as Okta, Microsoft and even hydra use the scp field to specify the oauth2 scope to be validated. Do we need to pass the scope field as an environment variable, in order not to break the current use with "scope" ? It is a pretty big deal to differ from the RFC as mentionned http://self-issued.info/docs/draft-ietf-oauth-token-exchange-03.html#scopes and some big jwt implementation providers (https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens, OKTA access token scp https://developer.okta.com/docs/api/resources/oidc).

from oathkeeper.

Hm, I think we could probably default to scp and have a configuration setting in the route which sets the key, for example:

    "authenticators": [{
        "handler": "oauth2_client_credentials",
        "config": {
            "required_scope": ["scope-a", "scope-b"],
            "scope_keys": ["scp", "scope"]
        }
    }],

What do you think about that?

from oathkeeper.

Handler : "jwt" in our usecase, but this fix clearly allows for multiple scope headers including "scp" as you mentionned earlier (if other people want to differ from ietf). Will you keep "scp" or "scope" as default one in order not to break previous oathkeeper implementations ?

from oathkeeper.

Oh yeah right, I mixed that up - but I think the same configuration would work there too :) Regarding BC, that's a good question. I think it makes sense to default to something that is being used more commonly and have a BC break here. Would you be open to PR this?

from oathkeeper.

Done on default values and test cases. Working on scope_keys feature.

from oathkeeper.

+1 - I have just hit this issue. It is a bit ironic that ORY Oathkeeper is not compatible with the tokens issued by ORY Hydra. I've been building the prototype with Hydra, Ambassador and Oathkeeper and ended up having this problem "Token is missing required scope...". Digged the code and found exactly that problem.

from oathkeeper.