OAuth2AuthHandlerImpl verifies the "offline_access" scope incorrectly

[xinchao-zhang]

Version

4.5.13

Context

I am using vertx-auth + vertx-web 4.5.13 to integrate with our enterprise OIDC provided by Azure. What I noticed is that if I include the scope "offline_access" in the token request (in order for Azure to issue refresh token), the authentication fails when vertx handles the callback redirect and throws the error:

"principal scope != handler scopes"

Looking at the code, it is the OAuth2AuthHandlerImpl throwing the exception because it tries to assert that the scopes returned by the IdP (through user.principal().get("scope")) must include all the scopes we have requested for. And "offline_access" is not there despite we have requested for it, and despite the response does have a refresh_token

Microsoft does not believe "offline_access" should ever be included in the returned scope.

OAuth2AuthHandlerImpl also does make a few exceptions and skip this validation if the scope requested is one of the OpenID standard defined scopes - openid, email, phone, profile, offline. But "offline" is not an OIDC defined scope, "offline_access" is.

Not an expert on the OpenID Connect standard, but should we change this:

  static {
    OPENID_SCOPES.add("openid");
    OPENID_SCOPES.add("profile");
    OPENID_SCOPES.add("email");
    OPENID_SCOPES.add("phone");
    OPENID_SCOPES.add("offline");
  }

to

  static {
    OPENID_SCOPES.add("openid");
    OPENID_SCOPES.add("profile");
    OPENID_SCOPES.add("email");
    OPENID_SCOPES.add("phone");
    OPENID_SCOPES.add("offline_access");
  }

in order to "whitelist" offline_access scope validation?

[pmlopes]

This is indeed a bug. Can you make a pull request with the change you already mentioned?

[tsegismont]

@pmlopes shouldn't this one be scoped to 5.0.2 if it's a bug?

[tsegismont]

@pmlopes In fact, perhaps 4.5.17?