search

thephpleague / oauth2-client

Easy integration with OAuth 2.0 service providers.
http://oauth2-client.thephpleague.com
MIT License
3.63k stars 751 forks source link

`AbstractProvider::getAccessToken` must send default scopes #1029

Open liayn opened 2 months ago

liayn commented 2 months ago

Using password grant to retrieve an access token some (all?) providers require a scope to be sent along. Examples are: Microsoft EntraID, WSO2 Documentation: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc#authorization-request

\League\OAuth2\Client\Provider\AbstractProvider::getAccessToken should therefore be adjusted to:

  1. Allow passing an array of scopes as an option
  2. Fall back to the default scopes of the provider if none are provided in step 1

Keep in mind that it is impossible to make a workaround for this issue. That is due to the fact that it is not possible to retrieve the scope separator or default scopes from outside a provider (methods are protected in interface!).