openid: support configuring scopes

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index 8ed9a8cbde94d7a2cac14867bbd8882011d5a641..02fa2b52c2bac25b0daf00d4f2bf8d2e849b4ca0 100644 (file)
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -38,6 +38,9 @@ my $lookup_openid_auth = sub {
     };
     $openid_config->{prompt} = $config->{'prompt'} if defined($config->{'prompt'});
 
     };
     $openid_config->{prompt} = $config->{'prompt'} if defined($config->{'prompt'});
 

+    my $scopes = $config->{'scopes'} // 'email profile';
+    $openid_config->{scopes} = [ PVE::Tools::split_list($scopes) ];
+

     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);
 };
     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);
 };

diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index 69b5b5e1912600aca598ac0857875e42b7a44ebe..0fbcde4428a3183d0d5f3517d4c176aa6391328f 100755 (executable)
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -49,6 +49,13 @@ sub properties {
            pattern => '(?:none|login|consent|select_account|\S+)', # \S+ is the extension variant
            optional => 1,
        },
            pattern => '(?:none|login|consent|select_account|\S+)', # \S+ is the extension variant
            optional => 1,
        },

+       scopes => {
+           description => "Specifies the scopes (user details) that should be authorized and"
+               ." returned, for example 'email' or 'profile'.",
+           type => 'string', # format => 'some-safe-id-list', # FIXME: TODO
+           default => "email profile",
+           optional => 1,
+       },

    };
 }
 
    };
 }
 


@@ -60,6 +67,7 @@ sub options {
        autocreate => { optional => 1 },
        "username-claim" => { optional => 1, fixed => 1 },
        prompt => { optional => 1 },
        autocreate => { optional => 1 },
        "username-claim" => { optional => 1, fixed => 1 },
        prompt => { optional => 1 },

+       scopes => { optional => 1 },

        default => { optional => 1 },
        comment => { optional => 1 },
     };
        default => { optional => 1 },
        comment => { optional => 1 },
     };