oauth2-proxy/pkg/apis
Mathias Mikkel Neerup 10726f83cc
feat: add --entra-id-redeem-scope option for token redemption scope
Microsoft Entra ID cannot issue an access token for multiple audiences.
The new --entra-id-redeem-scope option (alpha config:
microsoftEntraIDConfig.redeemScope) allows requesting a broad scope list
at authorization time while sending a narrowed, single-audience scope
when exchanging the authorization code for tokens, as permitted by
RFC 6749 section 3.3. If unset, behaviour is unchanged.

Applies to both the client-secret and federated-token redemption paths
of the entra-id provider.

Fixes #2751

Signed-off-by: Mathias Mikkel Neerup <mane@tv2.dk>
2026-07-10 13:40:50 +02:00
..
ip Move RealClientIP code to IP packages 2020-05-23 15:17:41 +01:00
middleware Merge commit from fork 2026-04-13 18:22:56 +02:00
options feat: add --entra-id-redeem-scope option for token redemption scope 2026-07-10 13:40:50 +02:00
sessions fix: improve logging when session refresh token is missing (#3327) 2026-03-23 10:54:32 +01:00