Rock 19.x OIDC: id_token missing because openid is never granted

[cbump]

Description

Following f0917ef (included in Rock 19.x), OIDC authorization code flows that request openid no longer receive an id_token from the token endpoint.

In RockWeb/Blocks/Security/Oidc/Authorize.ascx.cs, accept-authorization now calls ticket.SetScopes(clientAllowedScopes) instead of the previously narrowed requested scopes. Rock’s Auth Client UI does not expose openid, and helpers do not force-include it, so openid is dropped from the granted scopes even when the RP requested it. Without openid, the flow does not issue an ID token.

Granting openid does not expand what identity data is returned. Claims in the id_token (and UserInfo) remain gated by the Auth Client’s allowed scopes (profile, email, address, phone, etc.). openid only means “issue an ID token”; it does not by itself expose additional user attributes beyond those already permitted scopes.

Suggested fix: Restore granting the intersection of requested and client-allowed scopes, and/or always include openid when requested for an OIDC client. Restoring openid only restores ID token issuance; claim disclosure remains governed by the existing allowed-scope configuration.

Actual Behavior

The token response includes access_token (and optionally refresh_token) but no id_token, which breaks providers that rely on the ID token for subject/identity.

Expected Behavior

An authorization request that includes scope=openid should grant openid and return an id_token. Claim contents should continue to respect the client’s allowed scopes.

Steps to Reproduce

1. On Rock 19.2+, configure an OIDC Auth Client with allowed scopes such as profile, email, offline_access (whatever the UI allows — note openid is not configurable there).
2. Run an authorization code flow requesting e.g. scope=openid profile email offline_access
3. Complete login/consent and exchange the code at the token endpoint.
4. Observe: access_token is present, but id_token is missing — not because claim scopes were denied, but because openid was never granted.
5. (Optional) On pre-19 / pre-f0917ef with the same client and request: id_token is returned, and its claims still respect the client’s allowed scopes.

Issue Confirmation

• Perform a search on the Github Issues to see if your bug is already reported.
• Reproduced the problem on a fresh install or on the demo site.

Rock Version

19.x

Client Culture Setting

en-US