bugfix: move oidc scope logic to oidc provider

CHANGELOG.md

@@ -8,6 +8,8 @@
 
 ## Changes since v7.5.0
 
+- [#1989](https://github.com/oauth2-proxy/oauth2-proxy/pull/1989) Fix default scope for keycloak-oidc provider
+
 # V7.5.0
 
 ## Release Highlights

providers/oidc.go

@@ -24,16 +24,24 @@ type OIDCProvider struct {
 	SkipNonce bool
 }
 
+const oidcDefaultScope = "openid email profile"
+
 // NewOIDCProvider initiates a new OIDCProvider
 func NewOIDCProvider(p *ProviderData, opts options.OIDCOptions) *OIDCProvider {
-	p.setProviderDefaults(providerDefaults{
+	oidcProviderDefaults := providerDefaults{
 		name:        "OpenID Connect",
 		loginURL:    nil,
 		redeemURL:   nil,
 		profileURL:  nil,
 		validateURL: nil,
-		scope:       "",
-	})
+		scope:       oidcDefaultScope,
+	}
+
+	if len(p.AllowedGroups) > 0 {
+		oidcProviderDefaults.scope += " groups"
+	}
+
+	p.setProviderDefaults(oidcProviderDefaults)
 	p.getAuthorizationHeaderFunc = makeOIDCHeader
 
 	return &OIDCProvider{

providers/providers.go

@@ -158,16 +158,7 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
 		p.EmailClaim = providerConfig.OIDCConfig.UserIDClaim
 	}
 
-	if providerConfig.Type == "oidc" && p.Scope == "" {
-		p.Scope = "openid email profile"
-
-		if len(providerConfig.AllowedGroups) > 0 {
-			p.Scope += " groups"
-		}
-	}
-
 	p.setAllowedGroups(providerConfig.AllowedGroups)
-
 	return p, nil
 }