Search code examples
scopeauthorizationopenidopenid-connect

openID Connect : skip user consent if scope = openid

In OpenId Connect, if the scope (in the authentication request) is only "openid", could the OpenID Provider skip the consent page ?

Solution

  • It will depend on the OpenID Connect implementation of the authorization server. For example there could be claims that are appended to ID token by default which are not requested in the authorization request scope list (ex:- A user identifier). Thus there could be a consent page displayed from OpenID Connect provider even when scope value is limited to openid.

    Rather than when not to show consent page, specification highlight on the scope value offline_access (reference). This scope require prompt parameter consent in authorization request. Thus requiring consent page to be presented to end user.