Issue
With the OIDC SSO module, it was previously possible to save a configuration without selecting any scopes. In this scenario, the Identity Provider (IdP) would return a list of default scopes, and the configuration worked as expected.
Since OIDC version 4.5.0, saving a configuration without any scope selected is no longer possible. When attempting to save, the validation message At least one scope is required is displayed. This prevents maintaining or upgrading existing profiles where no scopes were selected.
Environment
OIDC SSO v4.5.0 and newer
Cause
A validation was introduced in OIDC version 4.5.0 that made at least one scope mandatory when saving a configuration. This change prevented existing configurations that relied on the IdP returning a list of default scopes (without explicitly selecting scopes) from being saved.
This new authentication request is aligned with OIDC standards, where the openid scope is required for OIDC authentication.
Solution/Workaround
To ensure compatibility and consistent behavior across different Identity Providers (IdPs), update the existing application configuration to include the required OAuth/OIDC scopes. At a minimum, the openid scope must be included, together with any additional scopes required by the application.
Review the current configuration and add the missing scopes where necessary. After the update, reauthenticate and verify that the authentication flow completes successfully.
Internal information related
- 281341
Additional information
Mendix documentation:
0 Comments