Authenticating with OAuth2?

[Cantor, Scott]

> Since his library is using pure OAuth2, he can't add a scope
> parameter to the request.

Scope is an OAuth2 concept, not an OpenID one. What makes an OAuth authorization request an OpenID request is the openid scope. The concept of scope is just core to OAuth so far as I understand it.

I think there's a bug in some of our flows though that don't allow omitting scope, Henri just fixed something there I think. Not sure about the authorization flow though.

Anyway, it's a bug.

The terminology and classes and all that are messy because we added OAuth support afterwards, but the "OIDC" endpoint is a pure OAuth endpoint, modulo bugs.

-- Scott