ncsa / oa4mp

Open Authorization for MyProxy
https://oa4mp.org/
Other
7 stars 10 forks source link

Do not send original scopes as refresh/exchange scopes unless they are explicitly sent in the request #155

Closed jjg-123 closed 2 months ago

jjg-123 commented 7 months ago

In QDL scripts, empty tx_scopes, tx_audience or tx_record should faithfully indicate that there were no scopes et al sent in the request rather than setting them to the original request. This allows scripts to differentiate between the arguments sent which can be necessary.

E.g. in the case of WLCG capability sets, which are only sent in the initial request and are treated as queries there. if they are in subsequent requests, they might be either ignored or raise an error.