Scope Validation is not working. Is a feature or dead code?

[filipeversehgi]

From what I see here in handler.lua, it's possible to pass multiple scopes to the plugin configuration and asks it to validate if the returned token has these scopes, is that correct?

https://github.com/revomatico/kong-oidc/blob/master/kong/plugins/oidc/handler.lua#L126

But it seems that this code only supports 1 scope, not multiple scopes.

I was wondering if this is a hidden feature, or is just some dead code that was left behind. I would be interested in submiting a PR if that's welcome.

[ahhduy]

I have same question.

[ruiengana]

Feature is working as expected. Please note it doesn't make sense to ask to validate 3 scopes for a single endpoint. You should review your API security practices.

[ahhduy]

Feature is working as expected. Please note it doesn't make sense to ask to validate 3 scopes for a single endpoint. You should review your API security practices.

Thank for your reply.

This is my config oidc:

{
  "protocols": [
    "grpc",
    "grpcs",
    "http",
    "https"
  ],
  "config": {
    "realm": "kong",
    "redirect_after_logout_uri": "/",
    "unauth_action": "auth",
    "discovery": "http://192.168.11.11:8080/realms/kong/.well-known/openid-configuration",
    "recovery_page_path": null,
    "timeout": null,
    "response_type": "code",
    "use_jwks": "yes",
    "session_secret": null,
    "bearer_jwt_auth_signing_algs": [
      "RS256"
    ],
    "ssl_verify": "no",
    "client_secret": "3hE3tAofmFe28inrPe7AygsXf6fxmlLf",
    "redirect_uri": null,
    "header_names": [],
    "client_id": "kong_client",
    "filters": null,
    "skip_already_auth_requests": "no",
    "redirect_after_logout_with_id_token_hint": "no",
    "bearer_jwt_auth_allowed_auds": null,
    "validate_scope": "yes",
    "bearer_jwt_auth_enable": "no",
    "token_endpoint_auth_method": "client_secret_post",
    "introspection_cache_ignore": "no",
    "post_logout_redirect_uri": null,
    "groups_claim": "groups",
    "ignore_auth_filters": null,
    "header_claims": [],
    "disable_userinfo_header": "no",
    "id_token_header_name": "X-ID-Token",
    "userinfo_header_name": "X-USERINFO",
    "introspection_endpoint": "http://192.168.11.11:8080/realms/kong/protocol/openid-connect/token/introspect",
    "revoke_tokens_on_logout": "no",
    "scope": "openid",
    "bearer_only": "no",
    "disable_access_token_header": "no",
    "introspection_endpoint_auth_method": "client_secret_basic",
    "access_token_header_name": "X-Access-Token",
    "access_token_as_bearer": "no",
    "disable_id_token_header": "no",
    "logout_path": "/logout"
  },
  "tags": null,
  "enabled": true,
  "route": null,
  "name": "oidc",
  "created_at": 1678863921,
  "consumer": null,
  "id": "2cf01a39-4d0d-4c4f-8b9d-7a048594d4f6",
  "service": {
    "id": "34a0c1b0-1cac-4e9c-a09d-cf5e2a3eb7db"
  }
}

I visit the configured route in kong with browser i get redirected to keycloak to authenticate and after success i can see my endpoint (anyuser I created in keycloak can access this endpoint through the browser). But when I using this code to get access token and connect to endpoint I got error: {"message":"Forbidden"}

#!/bin/bash

auth_url='http://localhost:8080/'
realm_name='kong'
client_id='kong_client'
client_secret='3hE3tAofmFe28inrPe7AygsXf6fxmlLf'
username='duypa'
password='123456aA'
url='http://localhost:8000/httpbin2'

token=$(curl -X POST \
   "${auth_url}/realms/${realm_name}/protocol/openid-connect/token" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d "client_id=${client_id}" \
   -d "client_secret=${client_secret}" \
   -d "username=${username}" \
   -d "password=${password}" \
   -d "grant_type=password" | jq -r '.access_token')
echo $token
curl -X GET \
   "${url}" \
   -H "Authorization: Bearer ${token}"

And after I check the access token, I don't see any value "openid" in scope. Maybe i made a mistake? Note that if I change the config.scope same like jwt access_token i get and remove default config "openid". I can connect to the endpoint with that code normally. But in browser , I got error. Thank u for reply.

[ruiengana]

Scope validation is not intended to be used with OpenID scope, that's the whole purpose of the oidc plugin.

[ahhduy]

Scope validation is not intended to be used with OpenID scope, that's the whole purpose of the oidc plugin.

I see. Thank you for your answer.