Merge pull request #20573 from markussiebert/fix/oidc-refresh-no-token

auth-backend(oidc-provider): Use requested scope if the refresh token request response has none

.changeset/five-spiders-listen.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Fixed bug in oidc refresh handler, if token endpoints response on refresh request does not contain a scope, the requested scope is used.

plugins/auth-backend/src/providers/oidc/provider.ts

@@ -130,6 +130,9 @@ export class OidcAuthProvider implements OAuthHandlers {
     if (!tokenset.access_token) {
       throw new Error('Refresh failed');
     }
+    if (!tokenset.scope) {
+      tokenset.scope = req.scope;
+    }
     const userinfo = await client.userinfo(tokenset.access_token);
 
     return {