requestClientCredentialsToken invalid scope in Keycloak

[DominicDetta]

Hi, in a client credentials flow the scope parameter is optional and the current implementation send the parameter anyway:

public function requestClientCredentialsToken() {
        $token_endpoint = $this->getProviderConfigValue('token_endpoint');

        $headers = [];

        $grant_type = 'client_credentials';

        $post_data = [
            'grant_type'    => $grant_type,
            'client_id'     => $this->clientID,
            'client_secret' => $this->clientSecret,
            'scope'         => implode(' ', $this->scopes)
        ];

        // Convert token params to string format
        $post_params = http_build_query($post_data, '', '&', $this->encType);

        return json_decode($this->fetchURL($token_endpoint, $post_params, $headers));
    }

In Keycloak this behaviour is not expected and return an error of invalid scopes.

To solve the error I need to specify the scope openid, but the right way would be the following implementation:

public function requestClientCredentialsToken() {
        $token_endpoint = $this->getProviderConfigValue('token_endpoint');

        $headers = [];

        $grant_type = 'client_credentials';

        $post_data = [
            'grant_type'    => $grant_type,
            'client_id'     => $this->clientID,
            'client_secret' => $this->clientSecret 
        ];
       
        if($this->scopes){
           $post_data['scope']=implode(' ', $this->scopes);
        }

        // Convert token params to string format
        $post_params = http_build_query($post_data, '', '&', $this->encType);

        return json_decode($this->fetchURL($token_endpoint, $post_params, $headers));
    }

[ricklambrechts]

According to the RFC 6749 (OAuth 2.0) the scope is indeed optional. I think this is a good solution.

[DominicDetta]

I created a pull request which need approval by maintainers.