uhhm/portal
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 89 Wiki Activity

The phone scope is asked for only when told to: Kanidm denies a scope the person lacks

Browse Source 
0.5.7 asked every provider for phoneNumber, so a Kanidm site could
not sign anyone in. OIDC_EXTRA_SCOPES=phoneNumber asks for it (Vipps).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt
This commit is contained in:
Bendik Aagaard Lynghaug
2026-09-30 13:40:12 +02:00
co-authored by Claude Fable 5.1
parent cc26a232ec
commit 6c86dc47a2
4 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/memberships.md
+4 -3
View File
@@ -76,9 +76,10 @@ memberships. With memberships:
- The `groups` claim, if the provider sends one, still counts: a
person's groups are the union.
The sign-in flow asks for the `phoneNumber` scope and reads
`phone_number` from userinfo; a provider without either gives nothing,
and matching falls back to the address.
With `OIDC_EXTRA_SCOPES=phoneNumber` the sign-in asks the provider for
the number and reads `phone_number` from userinfo. Set it for Vipps;
not for Kanidm, which denies a sign-in that asks for a scope the
person does not hold. Without it, matching falls back to the address.
## Asking who belongs