From 48e51c3383e3771b3cb8728e63c0d42094b95294 Mon Sep 17 00:00:00 2001
From: Thomas Lamprecht <t.lamprecht@proxmox.com>
Date: Thu, 18 Nov 2021 17:00:42 +0100
Subject: [PATCH] openid: support configuring scopes

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
---
 src/PVE/API2/OpenId.pm | 3 +++
 src/PVE/Auth/OpenId.pm | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index 8ed9a8c..02fa2b5 100644
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -38,6 +38,9 @@ my $lookup_openid_auth = sub {
     };
     $openid_config->{prompt} = $config->{'prompt'} if defined($config->{'prompt'});
 
+    my $scopes = $config->{'scopes'} // 'email profile';
+    $openid_config->{scopes} = [ PVE::Tools::split_list($scopes) ];
+
     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);
 };
diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index 69b5b5e..0fbcde4 100755
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -49,6 +49,13 @@ sub properties {
 	    pattern => '(?:none|login|consent|select_account|\S+)', # \S+ is the extension variant
 	    optional => 1,
 	},
+	scopes => {
+	    description => "Specifies the scopes (user details) that should be authorized and"
+	        ." returned, for example 'email' or 'profile'.",
+	    type => 'string', # format => 'some-safe-id-list', # FIXME: TODO
+	    default => "email profile",
+	    optional => 1,
+	},
    };
 }
 
@@ -60,6 +67,7 @@ sub options {
 	autocreate => { optional => 1 },
 	"username-claim" => { optional => 1, fixed => 1 },
 	prompt => { optional => 1 },
+	scopes => { optional => 1 },
 	default => { optional => 1 },
 	comment => { optional => 1 },
     };
-- 
2.39.2