OIDC providers not working after 2024.2.2 update - manual change required

[sjkjs]

Describe the bug
The purpose of this is to help other people who may have the same problem. This issue required manual action however was not mentioned in the 2024.2.2 release notes.

After updating to 2024.2.2 some of my OAuth2 providers no longer worked. Authentik returned error 403 when /application/o/userinfo/ was requested. Netbox for example gave this error when logging in:

403 Client Error: Forbidden for url: https:///application/o/userinfo/

This was found in Authentik logs:

{"auth_via": "unauthenticated", "domain_url": "", "event": "Scope mismatch.", "host": "", "level": "warning", "logger": "authentik.providers.oauth2.utils", "pid": 59, "request_id": "3f8257f1f2ca4e4c8fa820c00054e895", "required": "{'openid'}", "schema_name": "public", "timestamp": "2024-03-06T03:26:13.509364", "token_has": "{'profile', 'email'}"}

It seems that as of 2024.2.2 it is required to select the openid scope in OIDC providers. This was not the case in 2023.10 or prior.

To Reproduce
Steps to reproduce the behavior:

1. Install Authentik version 2023.10
2. Set up Netbox or another application using an OIDC provider that doesn't use the openid scope
3. Login will work correctly and everything is fine
4. Update Authentik to 2024.2.2
5. Login will no longer work and will give error 403 on /application/o/userinfo

Solution
Edit the OIDC provider and select "authentik default OAuth Mapping: OpenID 'openid'" in the scope list.

[BeryJu]

the openid scope has technically always been required for OpenID flows (according to the OpenID spec), and I'm not seeing any obvious places where this might have changed from 2023.10 to 2024.2. We'll update the docs to make this clearer, and also the openid scope is selected by default when creating a new provider

[authentik-automation]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.