The scope claim cannot be overriden with a Property Mapping #19224
Description
Describe the bug
Hello there!
I'm trying to override the scope OAuth claim using a Property Mapping that merges the requested OAuth scopes with some permission related scopes set using user attributes.
But the scope claim is not the one set by the Property Mapping. It is always set to the requested scopes. Using the same Property Mapping with a custom claim works. So only the claim literally named scope is affected.
How to reproduce
- Create a property mapping
token = request.context.get('token')
oauth_scopes = " ".join(token.scope) if token else ""
user_scopes = request.user.attributes.get("gltf_live_scopes", "")
scopes = f"{oauth_scopes} {user_scopes}".strip()
ak_logger.info("test_debug", scopes=scopes)
return {
"aud": "gltf-live",
"scope": scopes
}- Assign that property mapping to the OAuth provider
- Login
- Inspect the JWT
{
"aud": "gltf-live",
"scopes": "gltf-live email openid profile"
}Expected behavior
{
"aud": "gltf-live",
"scopes": "gltf-live email openid profile accessor:read accessor-sparse:read accessor-sparse-indices:read accessor-sparse-values:read asset:read buffer:read buffer-view:read camera:read gltf:read image:read mesh:read mesh-attribute:read mesh-primitive:read node:read node-extensions:read material:read material-extensions:read material-pbr-metallic-roughness:read material-normal-texture-info:read material-occlusion-texture-info:read sampler:read scene:read texture:read texture-info:read khr-lights-punctual:read khr-materials-unlit:read khr-xmp-json-ld:read accessor:write accessor-sparse:write accessor-sparse-indices:write accessor-sparse-values:write asset:write buffer:write buffer-view:write camera:write gltf:write image:write mesh:write mesh-attribute:write mesh-primitive:write node:write node-extensions:write material:write material-extensions:write material-pbr-metallic-roughness:write material-normal-texture-info:write material-occlusion-texture-info:write sampler:write scene:write texture:write texture-info:write khr-lights-punctual:write khr-materials-unlit:write khr-xmp-json-ld:write accessor:delete accessor-sparse:delete accessor-sparse-indices:delete accessor-sparse-values:delete asset:delete buffer:delete buffer-view:delete camera:delete gltf:delete image:delete mesh:delete mesh-attribute:delete mesh-primitive:delete node:delete node-extensions:delete material:delete material-extensions:delete material-pbr-metallic-roughness:delete material-normal-texture-info:delete material-occlusion-texture-info:delete sampler:delete scene:delete texture:delete texture-info:delete khr-lights-punctual:delete khr-materials-unlit:delete khr-xmp-json-ld:delete"
}Screenshots
No response
Additional context
The logs show that the scope field is properly computed in the Property Mapping. Which means the Property Mapping is running, but the generated claim is overridden afterward.
Deployment Method
Docker
Version
2025.10.3
Relevant log output
server-1 | {"auth_via": "oauth_client_secret", "domain_url": "127.0.0.1", "event": "test_debug", "host": "127.0.0.1:9000", "level": "info", "logger": "glTF Live OAuth Mapping: OpenID 'gltf-live'", "pid": 75, "request_id": "8ccab6b5ac694aa897dea497628797d4", "schema_name": "public", "scopes": "gltf-live email openid profile accessor:read accessor-sparse:read accessor-sparse-indices:read accessor-sparse-values:read asset:read buffer:read buffer-view:read camera:read gltf:read image:read mesh:read mesh-attribute:read mesh-primitive:read node:read node-extensions:read material:read material-extensions:read material-pbr-metallic-roughness:read material-normal-texture-info:read material-occlusion-texture-info:read sampler:read scene:read texture:read texture-info:read khr-lights-punctual:read khr-materials-unlit:read khr-xmp-json-ld:read accessor:write accessor-sparse:write accessor-sparse-indices:write accessor-sparse-values:write asset:write buffer:write buffer-view:write camera:write gltf:write image:write mesh:write mesh-attribute:write mesh-primitive:write node:write node-extensions:write material:write material-extensions:write material-pbr-metallic-roughness:write material-normal-texture-info:write material-occlusion-texture-info:write sampler:write scene:write texture:write texture-info:write khr-lights-punctual:write khr-materials-unlit:write khr-xmp-json-ld:write accessor:delete accessor-sparse:delete accessor-sparse-indices:delete accessor-sparse-values:delete asset:delete buffer:delete buffer-view:delete camera:delete gltf:delete image:delete mesh:delete mesh-attribute:delete mesh-primitive:delete node:delete node-extensions:delete material:delete material-extensions:delete material-pbr-metallic-roughness:delete material-normal-texture-info:delete material-occlusion-texture-info:delete sampler:delete scene:delete texture:delete texture-info:delete khr-lights-punctual:delete khr-materials-unlit:delete khr-xmp-json-ld:delete", "timestamp": "2026-01-07T11:25:40.066757"}