Merge pull request #22848 from gusevda/enable-persisted-scopes

Enable persisted scopes for OIDC authenticator

.changeset/eleven-walls-relate.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-oidc-provider': patch
+---
+
+Fixed a bug where the OIDC authenticator did not properly persist granted OAuth scopes.

plugins/auth-backend-module-oidc-provider/src/authenticator.ts

@@ -42,6 +42,7 @@ export type OidcAuthResult = {
 
 /** @public */
 export const oidcAuthenticator = createOAuthAuthenticator({
+  shouldPersistScopes: true,
   defaultProfileTransform: async (
     input: OAuthAuthenticatorResult<OidcAuthResult>,
   ) => ({
@@ -162,9 +163,6 @@ export const oidcAuthenticator = createOAuthAuthenticator({
     if (!tokenset.access_token) {
       throw new Error('Refresh failed');
     }
-    if (!tokenset.scope) {
-      tokenset.scope = input.scope;
-    }
     const userinfo = await client.userinfo(tokenset.access_token);
 
     return new Promise((resolve, reject) => {