providers/oauth2: allow property mappings to override scope claim in access tokens#19226
Merged
BeryJu merged 2 commits intogoauthentik:mainfrom Jan 15, 2026
Merged
Conversation
…mapping Reproduces issue goauthentik#19224 where property mappings cannot override the scope claim.
…s tokens Previously, the scope claim in access tokens was unconditionally set to the requested scopes, ignoring any custom scope value returned by property mappings. This change uses setdefault() instead of direct assignment, so the default scope is only set if no custom scope was provided by property mappings. Fixes goauthentik#19224
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
BeryJu
approved these changes
Jan 8, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #19226 +/- ##
==========================================
+ Coverage 92.86% 93.33% +0.46%
==========================================
Files 949 949
Lines 52372 52387 +15
==========================================
+ Hits 48635 48894 +259
+ Misses 3737 3493 -244
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
authentik-automation bot
pushed a commit
that referenced
this pull request
Jan 15, 2026
…access tokens (#19226) * test(oauth2): add failing test for scope claim override via property mapping Reproduces issue #19224 where property mappings cannot override the scope claim. * fix(oauth2): allow property mappings to override scope claim in access tokens Previously, the scope claim in access tokens was unconditionally set to the requested scopes, ignoring any custom scope value returned by property mappings. This change uses setdefault() instead of direct assignment, so the default scope is only set if no custom scope was provided by property mappings. Fixes #19224
Contributor
|
🍒 Cherry-pick to |
BeryJu
pushed a commit
that referenced
this pull request
Jan 15, 2026
…access tokens (#19226) * test(oauth2): add failing test for scope claim override via property mapping Reproduces issue #19224 where property mappings cannot override the scope claim. * fix(oauth2): allow property mappings to override scope claim in access tokens Previously, the scope claim in access tokens was unconditionally set to the requested scopes, ignoring any custom scope value returned by property mappings. This change uses setdefault() instead of direct assignment, so the default scope is only set if no custom scope was provided by property mappings. Fixes #19224
BeryJu
pushed a commit
that referenced
this pull request
Jan 15, 2026
…access tokens (cherry-pick #19226 to version-2025.12) (#19480) providers/oauth2: allow property mappings to override scope claim in access tokens (#19226) * test(oauth2): add failing test for scope claim override via property mapping Reproduces issue #19224 where property mappings cannot override the scope claim. * fix(oauth2): allow property mappings to override scope claim in access tokens Previously, the scope claim in access tokens was unconditionally set to the requested scopes, ignoring any custom scope value returned by property mappings. This change uses setdefault() instead of direct assignment, so the default scope is only set if no custom scope was provided by property mappings. Fixes #19224 Co-authored-by: Jean-Marc Le Roux <jeanmarc.leroux@aerys.in>
kensternberg-authentik
added a commit
that referenced
this pull request
Jan 31, 2026
* main: (47 commits) endpoints/connectors/agent: add tests for IA endpoint stage (#19487) website/docs: limiting permissions of AD service account (#19483) endpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (#19482) root: adjust makefile for non-brew macos (#19479) providers/oauth2: allow property mappings to override scope claim in access tokens (#19226) revert: lib: use orjson for structlog json (#19478) stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#19464) core: bump library/nginx from `e3a22a7` to `c881927` in /website (#19469) core: bump library/node from 25.2.1-trixie to 25.3.0-trixie in /website (#19468) web: bump prettier from 3.7.4 to 3.8.0 in /web (#19471) website/integrations: add MinIO AIStor configuration via environment variables (#19337) root: upgrade ruff lint for 3.14 (#19461) lib: use orjson for structlog json (#19462) ci: fix checkout stable (for 2025.12) (#19448) root: Python 3.14 (#17313) core: bump channels from 4.3.1 to 4.3.2 (#19458) core: bump mypy from 1.18.2 to 1.19.1 (#19457) core: bump google-api-python-client from 2.177.0 to 2.188.0 (#19443) core: bump selenium from 4.32.0 to 4.39.0 (#19455) core: bump msgraph-sdk from 1.39.0 to 1.52.0 (#19454) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
scopeclaim cannot be overriden with a Property Mapping #19224scopeclaim in OAuth2 access tokenssetdefault()instead of direct assignment so the default scope is only set if no custom scope was provided by property mappingsChanges
IDToken.to_access_token()inauthentik/providers/oauth2/id_token.pyto usesetdefault()for the scope claimtest_scope_claim_override_via_property_mappingto verify property mappings can override the scope claimRoot Cause
In
authentik/providers/oauth2/id_token.py:155, theto_access_token()method unconditionally overwrote thescopeclaim after property mapping claims were merged viato_dict():Fix
Changed to use
setdefault()which only sets the default if noscopekey exists:Test plan
test_scope_claim_override_via_property_mappingthat verifies property mappings can override the scope claimCloses #19224