configurable scopes for OpenID auth - #2083

Any chance that you could add a reasonable 'default' value in pom.xml or is a null value an acceptable value (null is what you'll get in the @Value annotation if there's no value copied in from the pom.xml)?

@chrisknoll I was looking into pac4j documentation, but haven't found anything specific on default values, so looked into source code here. And it looks like it's the same default null values, so I'm unsure on if it needs anything else.

I found some documentation on OpenID 'scope' but not sure if the scopes described there are the same property as the scope you are referring in this PR.

It seems to indicate that openid is a required scope, but it's also possible that it assumes that scope will be used for any access, so maybe the property is for 'additional scopes'. I don't know enough about OpenID to know.

Yes, that's the same.

The openid is actually required by the OpenID spec: here, so you may be right to have configuration like extraScopes.

I've made the changes, I agree, that would be more straightforward and up to spec.

Is there any other changes that may be needed? I like to move further with this with at least running the testing workflow.

If the default behavior here results in the same behavior pre-PR, then I'm fine with these changes. Are you asking if you should provide unit tests for these changes?

@chrisknoll Yes, it should be the same behavior, as openid is a required scope.

I was trying to find any example of tests, but saw nothing for OpenID tests.

Ok, I found some security tests (that make HTTP requests) here. Not sure if that makes a good model because, in the case of openid, we'd need some sort of testing context to mock an openid provider. Having a test case for this would be ideal, but we've left testing confirmation to external parties and accepted PRs on their certification.

@alex-odysseus or @anthonysena : do you have any OpenID environment set up that we could run an openID test using this new scope functionality?

@alex-odysseus perhaps ELIXIR could be a suitable place to test this functionality? Our test environment has expired but wondering if you have access to one with OpenID?

We'll accept this PR now because it appears to be low risk, and we can work on formalized unit tests for this functionality at a later date.

We will check it internally with Google I believe. We can also give it a try with Life Science (aka ELIXIR AAI) though I remember there were a few complications when we were implementing OpenID Connect (OIDC) in ARACHNE for this particular Identity Provider when scopes are involved @chrisknoll @anthonysena