Repository navigation
Handle Dynamic Scopes correctly in the consent screen #9224
Description
Description
Given the variable nature of Dynamic Scopes, a special consideration will be required when deciding whether to show a consent screen when a dynamic scope is used in the authentication request.
Some could be configured to always request consent, while others will be passed through if a dynamic scope with the same variable part has been consented before.
We'll also need to decide whether to show these Dynamic Scopes in the same screen as other scopes, or doing so on an individual screen to make it clearer that this scop 8000 e has a variable side that is different from previously consented scopes.
For now, there won't be the possibility of passing a wildcard (*) to let users input the variable part of it.
Discussion
Motivation
No response
Details
No response
Activity
pedroigor commentedon Dec 17, 2021
Does make sense to bypass consent for dynamic scopes? From my POV this type of scope is something that is related with a transaction or interaction that necessarily goes through user consent for approval (thinking about delegation scenarios only).
If that is true, we should show consent just like a static scope due to the fact that we are probably going to have some metadata associated with dynamic scopes?
dgozalo commentedon Dec 20, 2021
This is indeed a weird one.
For starters, it would seem like a dynamic scope that has been repeated, (i.e: passing
scope:123twice) would skip the consent screen the second time because, well, a scope with the same variable part has been consented before.But on the other hand, it could totally be a completely different "transaction" that needs to be consented every time. I.e: you could send the
amount:123twice, but they would be completely different transactions each time, so consent would be required at all times.So it boils down to:
I hope that makes sense.
pedroigor commentedon Dec 20, 2021
Yeah, by "necessarily goes through user consent" I meant that it should consent at least once. But I do see value in also forcing users to consent every time depending on your use case. However, I can not think about a use case where you have a dynamic scope that bypass the consent step completely.
In terms of UI, I think dynamic scopes should be shown on the same screen because. Why they would need a separate screen? At its core, it is just a scope, right?
dgozalo commentedon Dec 20, 2021
Agreed, we should never let a scope completely skip the consent screen. It should always show at least once.
About the UI, there were some discussions about having certain, separate screens for dynamic scopes when, for example, a user input would be necessary, to differentiate it from other static scopes.
But for now, it should be good enough to just show them all in the same screen.
[fixes keycloak#9224] - Get consented scopes from AuthorizationContext