Merge pull request #4476 from rmanny/remove-default-scope-oidc

Don't pass default as a scope to OIDC providers

.changeset/breezy-moles-reply.md

@@ -0,0 +1,35 @@
+---
+'@backstage/plugin-auth-backend': minor
+---
+
+Remove undocumented scope (default) from the OIDC auth provider which was breaking some identity services. If your app relied on this scope, you can manually specify it by adding a new factory in `packages/app/src/apis.ts`:
+
+```
+export const apis = [
+  createApiFactory({
+    api: oidcAuthApiRef,
+    deps: {
+      discoveryApi: discoveryApiRef,
+      oauthRequestApi: oauthRequestApiRef,
+      configApi: configApiRef,
+    },
+    factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+      OAuth2.create({
+        discoveryApi,
+        oauthRequestApi,
+        provider: {
+          id: 'oidc',
+          title: 'Your Identity Provider',
+          icon: OAuth2Icon,
+        },
+        defaultScopes: [
+          'default',
+          'openid',
+          'email',
+          'offline_access',
+        ],
+        environment: configApi.getOptionalString('auth.environment'),
+      }),
+  }),
+];
+```

plugins/auth-backend/src/providers/oidc/provider.ts

@@ -65,7 +65,7 @@ export class OidcAuthProvider implements OAuthHandlers {
     return await executeRedirectStrategy(req, strategy, {
       accessType: 'offline',
       prompt: 'none',
-      scope: `${req.scope} default`,
+      scope: req.scope,
       state: encodeState(req.state),
     });
   }