Specify required scopes per OP - Githubissues

dianagudu / motley_cue

A service for mapping OIDC identities to local identities, with local user management

https://motley-cue.readthedocs.io/

MIT License

8 stars 3 forks source link

Specify required scopes per OP #43

Closed dianagudu closed 1 year ago

dianagudu commented 2 years ago

configure scopes needed by motley_cue for each OP in motley_cue.conf and make them available via the /info endpoint.
scopes can then be used by clients (mccli, PuTTY+oidc-plugin) to request ATs with only needed scopes from oidc-agent.

will likely require an API change, i.e. to turn the supported_op array of strings into an array of dicts to be able to add more info per OP, e.g.:

"supported_OPs": [
 {
   "issuer": "https://aai.egi.eu/oidc/",
   "scopes_supported": [
     "openid",...
   ]
 },
 {
   "issuer": "https://wlcg.cloud.cnaf.infn.it/",
   "scopes_supported": [
     "openid",...
   ]
 },
 {
   "issuer": "https://login-dev.helmholtz.de/oauth2",
   "scopes_supported": [
     "openid",...
   ]
 }
],