OpenID default scope must contain "openid" at least

[Alvaro Lopez]

The OpenID auth plugins defaults the OpenID scope to scope='profile'. However, the OpenID specification states that "openid" MUST be specified [1], regardless of requesting any other scope.

[1] https://openid.net/specs/openid-connect-basic-1_0.html#Scopes

The plugins work, as the server behavior is unspecified, so the servers are returning a correct response, but the plugins should be fixed so that the default is scope="openid profile". This way we will be compliant with the specification, not changing the current behavior.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/330463
Committed: https://git.openstack.org/cgit/openstack/keystoneauth/commit/?id=68a7962488831bfb6cc9f72b7515a9d245fb2041
Submitter: Jenkins
Branch: master

commit 68a7962488831bfb6cc9f72b7515a9d245fb2041
Author: Alvaro Lopez Garcia <email address hidden>
Date: Thu Jun 16 11:20:14 2016 +0200

    oidc: fix OpenID scope management

    The OpenID scope is something common to all the OpenID grant types,
    therefore we move the OIDC scope parameter 'scope' from the OidcPassword
    class into the base _OidcBase class, moving the option as well into the
    corresponding loader.

    Moreover, OpenID scopes are not handled properly, as the loaders have
    the option defined as "openid-scope" whereas the class constructor
    argument is named "openid".

    Lastly, OpenID states that the OpenID scope MUST contain "openid" at
    least, so we should include this in our defaults argument.

    Closes-Bug: #1594272
    Closes-Bug: #1597334
    Change-Id: I9a242ae93a61737d032c19830c5d89ef6237f875

[Davanum Srinivas (DIMS) (dims-v)]

This issue was fixed in the openstack/keystoneauth 2.10.0 release.