openid: support configuring scopes

[pve-access-control.git] / src / PVE / Auth / OpenId.pm

diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index eb6c3518d311f0a2034b24d0b1415ccc530a5b82..0fbcde4428a3183d0d5f3517d4c176aa6391328f 100755 (executable)
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -42,6 +42,20 @@ sub properties {
            type => 'string',
            optional => 1,
        },
+       prompt => {
+           description => "Specifies whether the Authorization Server prompts the End-User for"
+               ." reauthentication and consent.",
+           type => 'string',
+           pattern => '(?:none|login|consent|select_account|\S+)', # \S+ is the extension variant
+           optional => 1,
+       },
+       scopes => {
+           description => "Specifies the scopes (user details) that should be authorized and"
+               ." returned, for example 'email' or 'profile'.",
+           type => 'string', # format => 'some-safe-id-list', # FIXME: TODO
+           default => "email profile",
+           optional => 1,
+       },
    };
 }
 
@@ -52,6 +66,8 @@ sub options {
        "client-key" => { optional => 1 },
        autocreate => { optional => 1 },
        "username-claim" => { optional => 1, fixed => 1 },
+       prompt => { optional => 1 },
+       scopes => { optional => 1 },
        default => { optional => 1 },
        comment => { optional => 1 },
     };