feat(db): allow overriding OIDC scopes via OIDC_SCOPES - #1027
Open
mfuhrmann wants to merge 3 commits into
Open
Conversation
wanderer requests openid, profile and email from every OIDC provider. Some providers reject an authorization request carrying scopes they do not know rather than ignoring them, so login fails before the consent screen is shown. OpenStreetMap accepts neither profile nor email and is therefore unusable as an OIDC provider today. Setting OIDC_SCOPES to a comma separated list replaces the scopes for the oidc, oidc2 and oidc3 providers. When unset, the PocketBase defaults are kept.
mfuhrmann
force-pushed
the
fix/osm-oidc-username
branch
from
August 10, 2026 11:05
76680f9 to
fb1447a
Compare
mfuhrmann
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Adds an
OIDC_SCOPESenvironment variable for thedbservice. When set, it replaces the scopes requested by theoidc,oidc2andoidc3providers with a comma-separated list. When unset, the PocketBase defaults are used, so existing installations are unaffected.Why
wanderer requests
openid,profileandemailfrom every OIDC provider. Some providers reject an authorization request that carries scopes they do not recognise, rather than ignoring the unknown ones — the login then fails before the user ever reaches the consent screen.OpenStreetMap is such a provider: it accepts neither
profilenoremail, which makes it unusable as an OIDC provider today. WithOIDC_SCOPES: "openid,read_prefs"it works.PocketBase itself offers no way to configure this.
core.OAuth2ProviderConfig(v0.38.0) exposesPKCE, the endpoint URLs, client credentials, display name and anExtramap, but no scope field — scopes come from the provider factory intools/auth, which is why this is an override of the factory rather than a settings change.How it was tested
db/main_test.gocovers the unset case, a single scope, a comma-separated list, surrounding whitespace, empty entries, and a separators-only value. The last two fall back to the provider defaults.openid,read_prefs.Notes
Whitespace around entries is trimmed and empty entries are dropped, so
"openid, read_prefs"behaves as expected.The scope list applies to all three OIDC provider slots. Configuring them separately would mean three variables; that seemed like the wrong trade until someone actually needs two different OIDC providers with two different non-default scope sets.
This PR previously also mapped the OAuth2 username from
preferred_username. That has been split out — testing showed it needs sanitising against theusernamefield pattern before it is safe, since OSM display names may contain spaces and other characters the field rejects. It will follow as a separate PR.Addresses root cause 1 of #1026. Root cause 2 (the discarded display name) is left for a separate PR.