yes, allow default scoping if the client doesn't ask for any.

2013-07-12 15:05:17 -04:00 · 2013-07-12 15:05:17 -04:00 · 9a6f345e15
parent 3d312b7eb5
commit 9a6f345e15
1 changed files with 1 additions and 1 deletions
--- a/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectAuthorizationRequestManager.java
+++ b/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectAuthorizationRequestManager.java
@ -114,7 +114,7 @@ public class ConnectAuthorizationRequestManager implements AuthorizationRequestM

 		Set<String> scopes = OAuth2Utils.parseParameterList(parameters.get("scope"));
 		if ((scopes == null || scopes.isEmpty())) {
-			//TODO: do we want to allow default scoping at all?
+			// default scoping
 			Set<String> clientScopes = client.getScope();
 			scopes = clientScopes;
 		}