diff --git a/fastapi_keycloak/api.py b/fastapi_keycloak/api.py index 40761fa..e43ee04 100644 --- a/fastapi_keycloak/api.py +++ b/fastapi_keycloak/api.py @@ -136,6 +136,7 @@ def __init__( admin_client_secret: str, callback_uri: str, admin_client_id: str = "admin-cli", + scope: str = "openid profile email", timeout: int = 10, ): """FastAPIKeycloak constructor @@ -150,6 +151,7 @@ def __init__( callback_uri (str): Callback URL of the instance, used for auth flows. Must match at least one `Valid Redirect URIs` of Keycloak and should point to an endpoint that utilizes the authorization_code flow. timeout (int): Timeout in seconds to wait for the server + scope (str): OIDC scope """ self.server_url = server_url self.realm = realm @@ -159,6 +161,7 @@ def __init__( self.admin_client_secret = admin_client_secret self.callback_uri = callback_uri self.timeout = timeout + self.scope = scope self._get_admin_token() # Requests an admin access token on startup @property @@ -979,6 +982,7 @@ def user_login(self, username: str, password: str) -> KeycloakToken: "username": username, "password": password, "grant_type": "password", + "scope": self.scope, } response = requests.post(url=self.token_uri, headers=headers, data=data, timeout=self.timeout) if response.status_code == 401: @@ -1062,9 +1066,9 @@ def _admin_request( @functools.cached_property def login_uri(self): - """The URL for users to login on the realm. Also adds the client id and the callback.""" + """The URL for users to login on the realm. Also adds the client id, the callback and the scope.""" params = { - "scope": "openid profile email", + "scope": self.scope, "response_type": "code", "client_id": self.client_id, "redirect_uri": self.callback_uri, diff --git a/tests/app.py b/tests/app.py index b576521..7103faf 100644 --- a/tests/app.py +++ b/tests/app.py @@ -23,6 +23,7 @@ admin_client_secret="BIcczGsZ6I8W5zf0rZg5qSexlloQLPKB", realm="Test", callback_uri="http://localhost:8081/callback", + scope="openid profile email", ) idp.add_swagger_config(app) diff --git a/tests/test_functional.py b/tests/test_functional.py index fa285f5..76c986b 100644 --- a/tests/test_functional.py +++ b/tests/test_functional.py @@ -426,10 +426,11 @@ def test_user_groups(self, idp, user): ) def test_login_exceptions(self, idp, action, exception, user): - # Get access and refresh for the users + # Get access, refresh and id token for the users tokens = idp.user_login(username=user.username, password=TEST_PASSWORD) assert tokens.access_token assert tokens.refresh_token + assert tokens.id_token user.requiredActions.append(action) # Add an action user: KeycloakUser = idp.update_user(user=user) # Save the change