Copilot commented on code in PR #13829: URL: https://github.com/apache/apisix/pull/13829#discussion_r3792004669
########## docs/zh/latest/plugins/openid-connect.md: ########## @@ -46,7 +46,7 @@ import TabItem from '@theme/TabItem'; | client_secret | string | 是 | | | OAuth 客户端密钥。 | | discovery | string | 是 | | | OpenID 提供商的 well-known 发现文档 URL，包含 OP API 端点列表。插件可直接使用发现文档中的端点。你也可以单独配置这些端点，单独配置的值优先于发现文档中提供的端点。 | | scope | string | 否 | openid | | 与认证用户相关信息对应的 OIDC 范围，也称为 [claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims)。用于授权具有适当权限的用户。默认值为 `openid`，这是 OIDC 返回唯一标识认证用户的 `sub` claim 所需的范围。可以附加额外的范围并以空格分隔，例如 `openid email profile`。 | -| required_scopes | array[string] | 否 | | | 访问令牌中必须存在的范围。在 `bearer_only` 为 `true` 时与 introspection 端点结合使用。如果缺少任何必需范围，插件将以 403 forbidden 错误拒绝请求。 | +| required_scopes | array[string] | 否 | | | 访问令牌中必须存在的范围。如果缺少任何必需范围，插件将以 403 forbidden 错误拒绝请求。在授权码流程中，已授予的范围取自访问令牌的 `scope` 声明，当访问令牌不是 JWT 时则取自 ID 令牌；无法确定已授予范围的会话同样会被拒绝。 | Review Comment: `required_scopes` 的说明写的是“当访问令牌不是 JWT 时才从 ID 令牌取 scope”，但实现是在无法从访问令牌读取 `scope` 时就会回退（包括访问令牌是 JWT 但不含 `scope` 声明的情况）。建议调整文档措辞以与实际行为一致。 ########## docs/en/latest/plugins/openid-connect.md: ########## @@ -46,7 +46,7 @@ The `openid-connect` Plugin supports the integration with [OpenID Connect (OIDC) | client_secret | string | True | | | OAuth client secret. | | discovery | string | True | | | URL to the well-known discovery document of the OpenID provider, which contains a list of OP API endpoints. The Plugin can directly utilize the endpoints from the discovery document. You can also configure these endpoints individually, which takes precedence over the endpoints supplied in the discovery document. | | scope | string | False | openid | | OIDC scope that corresponds to information that should be returned about the authenticated user, also known as [claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims). This is used to authorize users with proper permission. The default value is `openid`, the required scope for OIDC to return a `sub` claim that uniquely identifies the authenticated user. Additional scopes can be appended and delimited by spaces, such as `openid email profile`. | -| required_scopes | array[string] | False | | | Scopes required to be present in the access token. Used in conjunction with the introspection endpoint when `bearer_only` is `true`. If any required scope is missing, the Plugin rejects the request with a 403 forbidden error. | +| required_scopes | array[string] | False | | | Scopes required to be present in the access token. If any required scope is missing, the Plugin rejects the request with a 403 forbidden error. In the authorization code flow, the granted scopes are read from the `scope` claim of the access token, or of the ID token when the access token is not a JWT; a session whose granted scopes cannot be determined is rejected as well. | Review Comment: The description of `required_scopes` says the ID token is only used when the access token is not a JWT, but the implementation falls back whenever the access token’s `scope` cannot be read (including the case where it is a JWT but has no `scope` claim). Update the docs wording to match the actual behavior so operators know when a session will be rejected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
