"[oauth2_client] OPENID_CONNECT_SCOPES" can make "Additional Scopes" of "Authentication Source" useless #14058

New Issue

GiteaMirror · 2025-11-02T11:01:43-06:00

GiteaMirror commented

2025-11-02 11:01:43 -06:00

Originally created by @ghost on GitHub (Jan 27, 2025).

Description

Our Gitea instance connects to an external identity provider for unified identity management. I was adding a custom scope and a claim field to OIDC to let accounts in a certain OIDC group have Gitea instance administrator privilege. In "Edit Authentication Source" page I filled:

"Additional Scopes"
"Required Claim Name"
"Required Claim Value"
"Claim name providing group names for this source"
"Group Claim value for administrator users"
"Group Claim value for restricted users"

However, I noticed that OAuth url generated by Gitea wasn't including the custom scope, without which led to login prohibited by Gitea, as a result of absence of the custom claim field, which in turn was a result of absence of the custom scope, no matter how I modified "Additional Scopes". Troubleshot for hours long, I finally found that "OPENID_CONNECT_SCOPES" (https://github.com/go-gitea/gitea/blob/main/services/auth/source/oauth2/providers_openid.go#L37) will override "Additional Scopes" (https://github.com/go-gitea/gitea/blob/main/routers/web/admin/auths.go#L184) set in "Edit Authentication Source", making it literally useless before I removed the config item.

No error log.

Similar issue I looked at: https://github.com/go-gitea/gitea/issues/31612

Gitea Version

6ca91f555a

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

Git Version

No response

Operating System

No response

How are you running Gitea?

Docker compose

Database

PostgreSQL

Originally created by @ghost on GitHub (Jan 27, 2025). ### Description Our Gitea instance connects to an external identity provider for unified identity management. I was adding a custom scope and a claim field to OIDC to let accounts in a certain OIDC group have Gitea instance administrator privilege. In "Edit Authentication Source" page I filled: - "Additional Scopes" - "Required Claim Name" - "Required Claim Value" - "Claim name providing group names for this source" - "Group Claim value for administrator users" - "Group Claim value for restricted users" However, I noticed that OAuth url generated by Gitea wasn't including the custom scope, without which led to login prohibited by Gitea, as a result of absence of the custom claim field, which in turn was a result of absence of the custom scope, no matter how I modified "Additional Scopes". Troubleshot for hours long, I finally found that "OPENID_CONNECT_SCOPES" (https://github.com/go-gitea/gitea/blob/main/services/auth/source/oauth2/providers_openid.go#L37) will override "Additional Scopes" (https://github.com/go-gitea/gitea/blob/main/routers/web/admin/auths.go#L184) set in "Edit Authentication Source", making it literally useless before I removed the config item. No error log. Similar issue I looked at: https://github.com/go-gitea/gitea/issues/31612 ### Gitea Version 6ca91f555a ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots ![Image](https://github.com/user-attachments/assets/112ba98a-2723-4433-9955-a8674c3645dd) ![Image](https://github.com/user-attachments/assets/d8e3c665-44e0-4f3d-a810-a040510cc1e1) ![Image](https://github.com/user-attachments/assets/3e711b3a-10f2-4eb1-b473-5cf6f004c38b) ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Docker compose ### Database PostgreSQL

GiteaMirror added the topic/authentication type/bug labels 2025-11-02 11:01:43 -06:00

GiteaMirror commented

2025-11-02 11:01:44 -06:00

@jefferson-lima commented on GitHub (Jun 22, 2025):

I believe I've ran into the same issue when integrating Gitea with Authentik by following this tutorial. I got around this by using the groups claim instead.

@jefferson-lima commented on GitHub (Jun 22, 2025): I believe I've ran into the same issue when integrating Gitea with Authentik by following [this tutorial](https://docs.goauthentik.io/integrations/services/gitea/). I got around this by using the `groups` claim instead.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14058