openid: support configuring scopes

[pve-access-control.git] / src / PVE / API2 / OpenId.pm

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index 8ed9a8cbde94d7a2cac14867bbd8882011d5a641..02fa2b52c2bac25b0daf00d4f2bf8d2e849b4ca0 100644 (file)
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -38,6 +38,9 @@ my $lookup_openid_auth = sub {
     };
     $openid_config->{prompt} = $config->{'prompt'} if defined($config->{'prompt'});
 
+    my $scopes = $config->{'scopes'} // 'email profile';
+    $openid_config->{scopes} = [ PVE::Tools::split_list($scopes) ];
+
     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);
 };