Wenn OpenID Connect authorize scope auf openid email profile http://aleksis.org/_/oidc/groups_short gesetzt wird, bricht der OIDC-Login mit dem Fehler invalid_scope ab.
Message (11 copies reported)
(oidc) Authentication failure! invalid_scope: OmniAuth::Strategies::OAuth2::CallbackError, invalid_scope
Backtrace
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/activesupport-8.0.5.1/lib/active_support/broadcast_logger.rb:218:in 'block in ActiveSupport::BroadcastLogger#dispatch'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/activesupport-8.0.5.1/lib/active_support/broadcast_logger.rb:217:in 'Array#map'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/activesupport-8.0.5.1/lib/active_support/broadcast_logger.rb:217:in 'ActiveSupport::BroadcastLogger#dispatch'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/activesupport-8.0.5.1/lib/active_support/broadcast_logger.rb:129:in 'ActiveSupport::BroadcastLogger#error'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/omniauth-2.1.2/lib/omniauth/strategy.rb:163:in 'OmniAuth::Strategy#log'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/omniauth-2.1.2/lib/omniauth/strategy.rb:540:in 'OmniAuth::Strategy#fail!'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/omniauth-oauth2-1.7.3/lib/omniauth/strategies/oauth2.rb:89:in 'OmniAuth::Strategies::OAuth2#callback_phase'
/var/www/discourse/plugins/discourse-openid-connect/lib/omniauth_open_id_connect.rb:135:in 'OmniAuth::Strategies::OpenIDConnect#callback_phase'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/omniauth-2.1.2/lib/omniauth/strategy.rb:272:in 'OmniAuth::Strategy#callback_call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/omniauth-2.1.2/lib/omniauth/strategy.rb:194:in 'OmniAuth::Strategy#call!'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/omniauth-2.1.2/lib/omniauth/strategy.rb:169:in 'OmniAuth::Strategy#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/omniauth-2.1.2/lib/omniauth/builder.rb:44:in 'OmniAuth::Builder#call'
/var/www/discourse/lib/middleware/omniauth_bypass_middleware.rb:51:in 'Middleware::OmniauthBypassMiddleware#call'
/var/www/discourse/lib/middleware/crawler_hooks.rb:13:in 'Middleware::CrawlerHooks#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/tempfile_reaper.rb:15:in 'Rack::TempfileReaper#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/conditional_get.rb:27:in 'Rack::ConditionalGet#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/head.rb:12:in 'Rack::Head#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/http/permissions_policy.rb:38:in 'ActionDispatch::PermissionsPolicy::Middleware#call'
/var/www/discourse/lib/content_security_policy/middleware.rb:12:in 'ContentSecurityPolicy::Middleware#call'
/var/www/discourse/lib/middleware/anonymous_cache.rb:431:in 'Middleware::AnonymousCache#call'
/var/www/discourse/lib/middleware/csp_script_nonce_injector.rb:13:in 'Middleware::CspScriptNonceInjector#call'
/var/www/discourse/lib/middleware/track_view_session_id_injector.rb:12:in 'Middleware::TrackViewSessionIdInjector#call'
/var/www/discourse/config/initializers/008-rack-cors.rb:14:in 'Discourse::Cors#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/session/abstract/id.rb:266:in 'Rack::Session::Abstract::Persisted#context'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/session/abstract/id.rb:260:in 'Rack::Session::Abstract::Persisted#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/middleware/cookies.rb:706:in 'ActionDispatch::Cookies#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/middleware/callbacks.rb:31:in 'block in ActionDispatch::Callbacks#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/activesupport-8.0.5.1/lib/active_support/callbacks.rb:100:in 'ActiveSupport::Callbacks#run_callbacks'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/middleware/callbacks.rb:30:in 'ActionDispatch::Callbacks#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/middleware/debug_exceptions.rb:31:in 'ActionDispatch::DebugExceptions#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/middleware/show_exceptions.rb:32:in 'ActionDispatch::ShowExceptions#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/logster-2.21.0/lib/logster/middleware/reporter.rb:40:in 'Logster::Middleware::Reporter#call'
/var/www/discourse/lib/middleware/default_headers.rb:13:in 'Middleware::DefaultHeaders#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/railties-8.0.5.1/lib/rails/rack/logger.rb:41:in 'Rails::Rack::Logger#call_app'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/railties-8.0.5.1/lib/rails/rack/logger.rb:29:in 'Rails::Rack::Logger#call'
/var/www/discourse/config/initializers/100-quiet_logger.rb:20:in 'DiscourseRackQuietAssetsLogger#call'
/var/www/discourse/config/initializers/100-silence_logger.rb:29:in 'SilenceLogger#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/middleware/request_id.rb:34:in 'ActionDispatch::RequestId#call'
/var/www/discourse/lib/middleware/enforce_hostname.rb:23:in 'Middleware::EnforceHostname#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/method_override.rb:24:in 'Rack::MethodOverride#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/middleware/executor.rb:16:in 'ActionDispatch::Executor#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/sendfile.rb:127:in 'Rack::Sendfile#call'
/var/www/discourse/plugins/discourse-prometheus/lib/middleware/metrics.rb:14:in 'DiscoursePrometheus::Middleware::Metrics#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-mini-profiler-4.0.1/lib/mini_profiler.rb:191:in 'Rack::MiniProfiler#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/message_bus-4.5.2/lib/message_bus/rack/middleware.rb:60:in 'MessageBus::Rack::Middleware#call'
/var/www/discourse/lib/middleware/request_tracker.rb:381:in 'Middleware::RequestTracker#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/actionpack-8.0.5.1/lib/action_dispatch/middleware/remote_ip.rb:96:in 'ActionDispatch::RemoteIp#call'
/var/www/discourse/lib/middleware/overload_protections.rb:18:in 'Middleware::OverloadProtections#call'
/var/www/discourse/lib/middleware/processing_request.rb:14:in 'Middleware::ProcessingRequest#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/railties-8.0.5.1/lib/rails/engine.rb:535:in 'Rails::Engine#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/railties-8.0.5.1/lib/rails/railtie.rb:226:in 'Kernel#public_send'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/railties-8.0.5.1/lib/rails/railtie.rb:226:in 'Rails::Railtie.method_missing'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/urlmap.rb:74:in 'block in Rack::URLMap#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/urlmap.rb:58:in 'Array#each'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/urlmap.rb:58:in 'Rack::URLMap#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/tempfile_reaper.rb:15:in 'Rack::TempfileReaper#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork/chunked.rb:105:in 'Pitchfork::Chunked#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/rack-2.2.23/lib/rack/content_length.rb:17:in 'Rack::ContentLength#call'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork/http_server.rb:868:in 'Pitchfork::HttpServer#process_client'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork/http_server.rb:1017:in 'Pitchfork::HttpServer#worker_loop'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork/http_server.rb:616:in 'block in Pitchfork::HttpServer#spawn_worker'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork/http_server.rb:1222:in 'block in Pitchfork::HttpServer#fork_sibling'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork.rb:170:in 'block in Pitchfork.clean_fork'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork.rb:168:in 'Kernel#catch'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork.rb:168:in 'Pitchfork.clean_fork'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork/http_server.rb:690:in 'Pitchfork::HttpServer#spawn_initial_mold'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/lib/pitchfork/http_server.rb:176:in 'Pitchfork::HttpServer#start'
/var/www/discourse/vendor/bundle/ruby/3.4.0/gems/pitchfork-0.18.2/exe/pitchfork:110:in '<top (required)>'
/var/www/discourse/vendor/bundle/ruby/3.4.0/bin/pitchfork:25:in 'Kernel#load'
/var/www/discourse/vendor/bundle/ruby/3.4.0/bin/pitchfork:25:in '<main>'
Env
HTTP HOSTS: forum.teckids.org
Ich räume ein, dass die meisten Websites ein solches Scope nicht verwenden würden, aber es wird von der Spezifikation erlaubt. Da benutzerdefinierte Scopes und Claims als eindeutig garantiert werden sollten, ist die Verwendung einer URI unter der Kontrolle des IdP-Anbieters sinnvoll.
Ich weiß nicht genau, wo es schiefgeht, aber ich gehe davon aus, dass es sich um einen Fehler beim URL-Escaping handelt.