uhhm/portal
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 89 Wiki Activity

The phone scope is asked for only when told to: Kanidm denies a scope the person lacks

Browse Source 
0.5.7 asked every provider for phoneNumber, so a Kanidm site could
not sign anyone in. OIDC_EXTRA_SCOPES=phoneNumber asks for it (Vipps).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt
This commit is contained in:
Bendik Aagaard Lynghaug
2026-09-30 13:40:12 +02:00
co-authored by Claude Fable 5.1
parent cc26a232ec
commit 6c86dc47a2
4 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/oidc.rs
+9 -6
View File
@@ -149,7 +149,7 @@ pub async fn login(
let oidc = state.oidc.configured()?;
let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
let (auth_url, csrf_state, nonce) = oidc
let mut request = oidc
.client
.authorize_url(
CoreAuthenticationFlow::AuthorizationCode,
@@ -159,11 +159,14 @@ pub async fn login(
.add_scope(Scope::new("openid".to_string()))
.add_scope(Scope::new("profile".to_string()))
.add_scope(Scope::new("email".to_string()))
// A provider that verifies phone numbers (Vipps) gives one for
// this scope; Kanidm ignores a scope it does not know.
.add_scope(Scope::new("phoneNumber".to_string()))
.set_pkce_challenge(pkce_challenge)
.url();
.set_pkce_challenge(pkce_challenge);
// What else to ask the provider for: `phoneNumber` for one that
// verifies numbers (Vipps). Only when asked, because Kanidm denies
// a sign-in that requests a scope the person does not hold.
for scope in std::env::var("OIDC_EXTRA_SCOPES").unwrap_or_default().split_whitespace() {
request = request.add_scope(Scope::new(scope.to_string()));
}
let (auth_url, csrf_state, nonce) = request.url();
session
.insert(PKCE_KEY, pkce_verifier.secret())