From d08e82d8b4458b53a0ad9aa19a953cfb9f92d2e9 Mon Sep 17 00:00:00 2001 From: ataylorme Date: Fri, 13 Oct 2023 10:55:13 -0700 Subject: [PATCH] Add Okta `scope` to `Okta Authentication Provider` docs page Signed-off-by: ataylorme --- docs/auth/okta/provider.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/auth/okta/provider.md b/docs/auth/okta/provider.md index e4fc8bfb45..a0febe29f4 100644 --- a/docs/auth/okta/provider.md +++ b/docs/auth/okta/provider.md @@ -43,6 +43,8 @@ auth: audience: ${AUTH_OKTA_DOMAIN} authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional idp: ${AUTH_OKTA_IDP} # Optional + # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned + scope: ${AUTH_OKTA_SCOPE} # Optional ``` The values referenced are found on the Application page on your Okta site. @@ -55,6 +57,8 @@ The values referenced are found on the Application page on your Okta site. - `authServerId`: The authorization server ID for the Application - `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3` +`scope` is an optional value to change the `scope` value sent to Okta during OAuth. The default value is `openid profile email offline_access`. Chaning the `scope` will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, adding `groups` to the `scope` by setting the value to `openid profile email offline_access groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app. + ## Adding the provider to the Backstage frontend To add the provider to the frontend, add the `oktaAuthApi` reference and