oauth login silently ignores scope

[Jamie Lennox]

OAuth authentication is always scoped within an oauth authentication.

Because it's still just a v3 authentication you can provide your own scope with a oauth request. Whatever you provide as scope to the authentication is silently ignored and your token is scoped to whatever project the oauth is scoped to.

Note: This should not be a security risk because you are always being scoped to where your authorization is. The oauth scope is being used in preference to your request scope.

I think this should fail. If you provide scope information seperate and different from your oauth scope information then this should be a bad request and you should not get a token.

I'm attaching the test script i'm using to play with oauth. You can run it with the admin credentials from devstack.

[Dolph Mathews (dolph)]

I agree, you should get a 400 error - the scope will never be honored in conjuction with OAuth (just like with trusts).

[David Stanek (dstanek)]

Unassigned due to inactivity.

[Lance Bragstad (lbragstad)]

Automatically unassigning due to inactivity.

[Colleen Murphy (krinkle)]

This would be an API breaking change. I don't think we can accept this until we implement microversions or decide we want a v4.