Microsoft Entra ID cannot issue an access token for multiple audiences.
The new --entra-id-redeem-scope option (alpha config:
microsoftEntraIDConfig.redeemScope) allows requesting a broad scope list
at authorization time while sending a narrowed, single-audience scope
when exchanging the authorization code for tokens, as permitted by
RFC 6749 section 3.3. If unset, behaviour is unchanged.
Applies to both the client-secret and federated-token redemption paths
of the entra-id provider.
Fixes#2751
Signed-off-by: Mathias Mikkel Neerup <mane@tv2.dk>
* Microsoft Entra ID Provider
* fix typo in function name
* documentation tweaks
* documentation and comment tweak
* docs tweaks
* final tweaks
* refactor: drop flag for skipping graph groups
* update legacy / deprecated provider page and sort provider overview
* reformat
* move entra-id provider into switch (treat like every other provider
* fix test case and reformat
* fix sidebar configuration
* apply review suggestions
* add pagination for graph api
* fix: do not error when groups unable to retrieve
* doc: number of groups fix
* restore master packages
* docs: tiny docs tweak
* address review comments
* fix codegen
---------
Co-authored-by: tuunit <jan@larwig.com>
Mathias Mikkel Neerup
Jan Larwig
Olivier Mengué
JJ Łakis