Default DEFAULT_OAUTH2_REQUEST_PERMISSIONS do not work with keycloak

[lukasjelonek]

Problem

I wanted to setup wekan (snap on ubuntu) with keycloak 11.0.2 and followed the documentation in the wiki. Unfortunately the described way always opened a login-popup and closed it immediately. The reason was an unsupported request of scopes.

After some investigation I realized that the wekan snap uses an incompatible scope request. The default value quotes the scopes with single ticks. After configuring it without the additional single quotes, it worked.

I can't tell if changing the defaults will be a problem for other oidc-Providers, but at least keycloak 11.0.2 rejects these requests.

Suggested (simple) Solutions

Either change defaults

DEFAULT_OAUTH2_REQUEST_PERMISSIONS="'openid profile email'"

change it to

DEFAULT_OAUTH2_REQUEST_PERMISSIONS="openid profile email"

Or add to keycloak wiki entry

sudo snap set wekan oauth2-scopes='openid profile email'