Openid connect issues (using Fusionauth) -- scopes are not provided

[BarryCarlyon]

@tauinger-de

Do you work for Twitch?

No

@tauinger-de

If yes, then please update the documentation, which is very misleading especially Using OIDC to get OAuth Access Tokens | Twitch Developers where it links to the scopes available – and doesn’t mention at all that all these scopes are not honored.

OpenID requires Claims as per the OpenID spec.

I do not see a fault in the documentation.user:read:email (or the other user related scopes) does not grant access to the users email when calling OpenID and it’s user info endpoint, that requires a claim.

Using OIDC to get OAuth Access Tokens

If you request the right claims then the userinfo endpoint will include that data.

@tauinger-de

Furthermore you can resolve the scope=<space-separated list of scopes> part with scope=openid since any other scope isn’t supported

if you include other scopes then you also get back a regular oAuth token that you can use against the none OpenID related endpoints.

The docs

Using OIDC to get OAuth Access Tokens

state that the scope MUST include openid

scope string Space-separated list of scopes. This must include the openid scope.

if you include other scopes that doesn’t change the data openID returns, just gives you a standard oAuth token that can be used on the “regular” Twitch API