oauth - 访问 token 没有 openid 范围

Question

我正在做 sso 示例 (travelocity.com) 示例。当我尝试使用此命令通过 oauth 访问 token 访问用户信息时，

curl -k -H "Authorization: Bearer b68ba941c9da3d2644d8a63154d28" https://localhost:9443/oauth2/userinfo?schema=openid

出现以下错误

{"error":"insufficient_scope","error_description":"Access token does not have the openid scope"}

求助，谢谢

Answer 1

当您向授权端点发出第一个请求时，您必须在 scope 请求参数中包含 openid。 OpenID Connect Core 1.0, 3.1.2.1. Authentication Request说如下。

scope

REQUIRED. OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. Scope values used that are not understood by an implementation SHOULD be ignored. See Sections 5.4 and 11 for additional scope values defined by this specification.