PPSC-1177: fix SSO-SETUP scope list and Okta groups claim guidance - #290
Merged
dmitrysmirnov-armis merged 1 commit intoJul 28, 2026
Conversation
…PPSC-1177] Remove non-standard `groups` scope from the listed OIDC scopes (only `openid`, `email`, `profile` are standard). Group membership is delivered via an ID-token claim configured on the IdP, not a requested scope; requesting `groups` as a scope causes Okta to reject the authorization with invalid_scope. Also clarify the Okta note: the groups claim must be set to emit Always, not gated on a specific scope, so it is included in the token. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
|
dmitrysmirnov-armis
marked this pull request as ready for review
July 27, 2026 16:13
shb7628
approved these changes
Jul 27, 2026
Test Coverage Reporttotal: (statements) 72.3% Coverage by function |
yiftach-armis
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue
Type of Change
Problem
The
docs/SSO-SETUP.mdguide listedgroupsas a requested OIDC scope (openid,email,profile,groups).groupsis not a standard OIDC scope — group membership is delivered as an ID-token claim configured on the IdP, not requested via a scope. Requesting it caused Okta to reject the entire authorization withinvalid_scope, breaking SSO login for Okta tenants.The doc was also internally contradictory: it listed
groupsas a scope to request, while correctly instructing admins to configuregroupsas a token claim in Okta/Entra/Keycloak.Solution
groupsfrom the listed OIDC scopes (nowopenid,email,profileonly).groupsclaim must be set to emit Always (not gated on a specific scope), so it is included in the token even thoughgroupsis no longer a requested scope.The API-controller fix (removing
groupsfromOIDC_DEFAULT_SCOPESinconstants.py) is handled in the Project-Moose repo.Testing
Automated Tests
Manual Testing
Documentation-only change. Verified by reading the updated
docs/SSO-SETUP.mdto confirm the scope list and Okta claim instructions are consistent and accurate.Reviewer Notes
No code changes — docs only. The Okta "Always" note is the key addition: without it, an admin who followed the old guide (claim gated on the
groupsscope) would silently stop receiving the claim after the API-controller fix removesgroupsfrom the requested scopes.Checklist