Merge pull request #20580 from ataylorme/feat/okta-auth-scope-option

Allow user-defined scopes for Okta auth in config yaml

docs/auth/okta/provider.md

@@ -43,6 +43,8 @@ auth:
         audience: ${AUTH_OKTA_DOMAIN}
         authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional
         idp: ${AUTH_OKTA_IDP} # Optional
+        # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned
+        additionalScopes: ${AUTH_OKTA_ADDITIONAL_SCOPES} # Optional
 ```
 
 The values referenced are found on the Application page on your Okta site.
@@ -55,6 +57,8 @@ The values referenced are found on the Application page on your Okta site.
 - `authServerId`: The authorization server ID for the Application
 - `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3`
 
+`additionalScopes` is an optional value, a string of space separated scopes, that will be combined with the default `scope` value of `openid profile email offline_access` to adjust the `scope` sent to Okta during OAuth. This will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, setting the `additionalScopes` value to `groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app.
+
 ## Adding the provider to the Backstage frontend
 
 To add the provider to the frontend, add the `oktaAuthApi` reference and