diff --git a/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectAuthorizationRequestManager.java b/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectAuthorizationRequestManager.java index f8b819823..66cd1a600 100644 --- a/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectAuthorizationRequestManager.java +++ b/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectAuthorizationRequestManager.java @@ -119,12 +119,7 @@ public class ConnectAuthorizationRequestManager implements AuthorizationRequestM Set scopes = OAuth2Utils.parseParameterList(parameters.get("scope")); if ((scopes == null || scopes.isEmpty())) { //TODO: do we want to allow default scoping at all? - // If no scopes are specified in the incoming data, it is possible to default to the client's - //registered scopes, but minus the "openid" scope. OpenID Connect requests MUST have the "openid" scope. Set clientScopes = client.getScope(); - if (clientScopes.contains("openid")) { - clientScopes.remove("openid"); - } scopes = clientScopes; } DefaultAuthorizationRequest request = new DefaultAuthorizationRequest(inputParams, Collections. emptyMap(), clientId, scopes);