Use minimal OpenID scope

negz · Mar 19, 2018 · e179baa · e179baa
1 parent af9266a
commit e179baa
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/kuberos.go b/kuberos.go
@@ -48,7 +48,7 @@ const (
 var (
 	// DefaultScopes are the minimum required oauth2 scopes for every
 	// authentication request.
-	DefaultScopes = []string{oidc.ScopeOpenID, "profile", "email"}
+	DefaultScopes = []string{oidc.ScopeOpenID}
 
 	// ErrInvalidKubeCfgEndpoint indicates an unparseable redirect endpoint.
 	ErrInvalidKubeCfgEndpoint = errors.New("invalid redirect endpoint")

diff --git a/kuberos_test.go b/kuberos_test.go
@@ -41,7 +41,7 @@ func TestAuthCodeURL(t *testing.T) {
 				RedirectURL:  "https://example.org/redirect",
 			},
 			s:   func(_ *http.Request) string { return "state" },
-			url: "https://auth.example.org?access_type=offline&client_id=testClientID&prompt=consent&redirect_uri=http%3A%2F%2Fexample.com%2Fui&response_type=code&scope=openid+profile+email&state=state",
+			url: "https://auth.example.org?access_type=offline&client_id=testClientID&prompt=consent&redirect_uri=http%3A%2F%2Fexample.com%2Fui&response_type=code&scope=openid&state=state",
 		},
 		{
 			name: "CustomScopes",