Tenant-scoped sessions

[byewokko]

Tenants in scope

OIDC authorize scope parameter now takes a list of requested tenants that should be accessible from the client session, e.g.

scope=openid tenant:my-tenant tenant:another-tenant

Encoded

GET /openidconnect/authorize?...&scope=openid%20tenant%3Amy-tenant%20tenant%3Aanother-tenant

Specifying tenant:* in scope requests authorization for all the user's tenants.

Specifying tenant in scope requests authorization for the user's last accessed tenant.

Not including any tenants in the scope results in a session that has only access to global resources.

Userinfo scope

In order to reduce the size of user info and ID token, only the essential details are included in userinfo response by default. Additional details must be requested in scope:

• userinfo:username includes username
• userinfo:email includes email address
• userinfo:phone includes phone number
• userinfo:data includes custom credential data
• userinfo:authn includes info about login factors and descriptors
• userinfo:* includes all of the fields above

Changes

• BREAKING Tenant-aware sessions require specifying tenant in authorization scope.
• Successful and failed authorize attempts are recorded in the audit.
• System resource authz:tenant:access allows the user to enter any tenant with their global resources (solves Resource for access to all tenants #83).
• Userinfo field preferred_username renamed to username. The original field is preserved for backward compatibility.
• Userinfo field phone_number renamed to phone. The original field is preserved for backward compatibility.

[byewokko]

Further questions:

• Root session now does not include any tenant. OK?