<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
The OAuth 2.0 Specification, in section 3.3, says the following [1]:<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
If the client omits the scope parameter when requesting<br>
authorization, the authorization server MUST either process the<br>
request using a pre-defined default value or fail the request<br>
indicating an invalid scope. The authorization server SHOULD<br>
document its scope requirements and default value (if defined).<br>
<br>
Messages section 2.4 [2] does not give any additional guidance about
what to do if the client does not specify a scope value when making
a request; however, it does indicate that the "openid" scope value
MUST be included for the request to be treated as an OpenID Connect
request (rather than an OAuth 2.0 request). <br>
<br>
What is the server required/allowed to do if the client omits to
send the scope parameter? Does that MUST disallow an OIDC server
from defaulting a non-scoped request to include the "openid" scope?
<br>
<br>
[1]
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a href="http://tools.ietf.org/html/rfc6749#section-3.3">http://tools.ietf.org/html/rfc6749#section-3.3</a><br>
[2]
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a
href="http://openid.net/specs/openid-connect-messages-1_0.html#scopes">http://openid.net/specs/openid-connect-messages-1_0.html#scopes</a><br>
<br>
--Amanda<br>
</body>
</html>