Description

Keycloak need to be extended in order to be able to hide client scopes from discovery( OpenID Provider Metadata).

We propose to add ClientScopeAttributeEntity with name hideFromOpenIDProviderMetadata (label = Hide from OpenID Provider Metadata) with default value as false. If this value become true, this scope will not listed in OpenID Provider Metadata.

Finally, with this implementation no change is needed during migration.

Discussion

No response

Motivation

According to https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata:

The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in OpenID.Core SHOULD be listed, if supported.

Details

No response