feat: configurable scopes and issuer check skipping

client.go

@@ -190,6 +190,7 @@ func NewClient(opts ...OptionFunc) *Client {
 
 	verifier := opt.Provider.Verifier(&oidc.Config{
 		ClientID:        opt.ClientID,
+		SkipIssuerCheck: opt.SkipIssuerCheck,
 	})
 
 	return &Client{oauth2, opt.Provider, verifier, opt.AcrValues}

cmd/server/container.go

@@ -92,8 +92,9 @@ func getServiceContainer(ctx context.Context, conf *config.Config) (*service.Con
 	ctn.Provide(oidc.ServiceName, oidc.ServiceProvider(
 		oidc.WithCredentials(conf.OIDC.ClientID, conf.OIDC.ClientSecret),
 		oidc.WithProvider(provider),
-		oidc.WithScopes("email", "openid"),
+		oidc.WithScopes(conf.OIDC.Scopes...),
 		oidc.WithAcrValues(conf.OIDC.AcrValues),
+		oidc.WithSkipIssuerCheck(conf.OIDC.SkipIssuerVerification),
 	))
 
 	return ctn, nil

internal/config/config.go

@@ -56,6 +56,7 @@ type OIDCConfig struct {
 	InsecureSkipVerify     bool     `yaml:"insecureSkipVerify" env:"OIDC_INSECURE_SKIP_VERIFY"`
 	AcrValues              string   `yaml:"acrValues" env:"OIDC_ACR_VALUES"`
 	SkipIssuerVerification bool     `yaml:"skipIssuerVerification" env:"OIDC_SKIP_ISSUER_VERIFICATION"`
+	Scopes                 []string `yaml:"scopes" env:"OIDC_SCOPES"`
 }
 
 type LogConfig struct {
@@ -90,7 +91,9 @@ func NewDefault() *Config {
 			RedirectURL:            "http://localhost:3002/oauth2/callback",
 			PostLogoutRedirectURL:  "http://localhost:3002",
 			InsecureSkipVerify:     false,
+			SkipIssuerVerification: false,
 			AcrValues:              "",
+			Scopes:                 []string{"openid", "email"},
 		},
 	}
 }

option.go

@@ -15,6 +15,7 @@ type Option struct {
 	RedirectURL     string
 	Scopes          []string
 	AcrValues       string
+	SkipIssuerCheck bool
 }
 
 func WithRedirectURL(url string) OptionFunc {
@@ -42,6 +43,12 @@ func WithAcrValues(acrValues string) OptionFunc {
 	}
 }
 
+func WithSkipIssuerCheck(skip bool) OptionFunc {
+	return func(opt *Option) {
+		opt.SkipIssuerCheck = skip
+	}
+}
+
 func NewProvider(ctx context.Context, issuer string, skipIssuerVerification bool) (*oidc.Provider, error) {
 	if skipIssuerVerification {
 		ctx = oidc.InsecureIssuerURLContext(ctx, issuer)