Skip to content

Add a note about the 'scopes' config parameter in OIDC provisioner #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 17, 2025
Merged

Add a note about the 'scopes' config parameter in OIDC provisioner #416

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
22660f7
Add a note about the 'scopes' config parameter in OIDC provisioner
tashian Jun 17, 2025
3d8d65d
Incorporate Mariano's feedback
tashian Jun 17, 2025
22ae762
Incorporate Mariano's feedback
tashian Jun 17, 2025
3fcde25
Remove note
tashian Jun 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion step-ca/provisioners.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
updated_at: March 27, 2025
updated_at: June 17, 2025
title: Configuring `step-ca` Provisioners
html_title: Configuring open source step-ca Provisioners
description: Learn how to configure step-ca Provisioners
Expand Down Expand Up @@ -645,6 +645,7 @@ Example `ca.json` provisioner configuration for a Google provisioner:
"configurationEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
"admins": ["you@smallstep.com"],
"domains": ["smallstep.com"],
"scopes": ["openid", "email"],
"listenAddress": ":10000",
"claims": {
"maxTLSCertDuration": "8h",
Expand Down Expand Up @@ -676,6 +677,8 @@ Example `ca.json` provisioner configuration for a Google provisioner:

- **domains**<Reference id="star3" marker="*" />: is the list of domains valid. If provided only the emails with the provided domains will be able to authenticate.

- **scopes**: a list of scopes OAuth clients should request. This is used by the `step` CLI. The default value is `["openid","email"]`.

- **listenAddress**<Reference id="star3" marker="*" />: is the address (`:port` or `host:port`) where the authorization server will redirect the client's web browser at the end of the authorization flow. By default, the `step` client will bind to 127.0.0.1 on a random port. This parameter is only required if the authorization server demands a specific port for loopback IP redirect URIs.

- **claims**<Reference id="star3" marker="*" />: overwrites the default claims set in the authority,
Expand Down