chore: default OIDC_API_REQUIRE_SCOPE_FOR_AUTHENTICATION to False

These used to be required with Tunnistamo, but kKeycloak based authentication does not normally use API scopes.
City-of-Helsinki · Jan 4, 2024 · 620ad7a · 620ad7a
1 parent 3a1dae8
commit 620ad7a
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 2 deletions.
diff --git a/config_dev.toml.example b/config_dev.toml.example
@@ -136,7 +136,7 @@ COOKIE_PREFIX=kkdev
 # to Tunnistamo instance.
 OIDC_API_AUDIENCE=https://auth.example.com/kerrokantasi
 OIDC_API_SCOPE_PREFIX=kerrokantasi
-OIDC_API_REQUIRE_SCOPE_FOR_AUTHENTICATION=True
+OIDC_API_REQUIRE_SCOPE_FOR_AUTHENTICATION=False
 OIDC_API_ISSUER=https://tunnistamo.example.com/openid
 OIDC_API_AUTHORIZATION_FIELD=https://auth.example.com
 

diff --git a/kerrokantasi/settings/base.py b/kerrokantasi/settings/base.py
@@ -74,7 +74,7 @@ def get_git_revision_hash():
     HELUSERS_BACK_CHANNEL_LOGOUT_ENABLED=(bool, False),
     OIDC_API_AUDIENCE=(list, [""]),
     OIDC_API_SCOPE_PREFIX=(list, ["kerrokantasi"]),
-    OIDC_API_REQUIRE_SCOPE_FOR_AUTHENTICATION=(bool, True),
+    OIDC_API_REQUIRE_SCOPE_FOR_AUTHENTICATION=(bool, False),
     OIDC_API_ISSUER=(list, [""]),
     OIDC_API_AUTHORIZATION_FIELD=(list, [""]),
     SOCIAL_AUTH_TUNNISTAMO_KEY=(str, ""),

diff --git a/kerrokantasi/settings/test_settings.py b/kerrokantasi/settings/test_settings.py
@@ -6,3 +6,4 @@
 OIDC_API_TOKEN_AUTH = globals()["OIDC_API_TOKEN_AUTH"]
 OIDC_API_TOKEN_AUTH["API_AUTHORIZATION_FIELD"] = ["authorization.permissions.scopes"]
 OIDC_API_TOKEN_AUTH["ISSUER"] = ["http://test.local:8000/openid"]
+OIDC_API_TOKEN_AUTH["REQUIRE_API_SCOPE_FOR_AUTHENTICATION"] = False