Create a new scope in OpenId-Module

[DavidStania]

Hi all,

today, I'm not sure what kind of feature I can use with the section "Scopes" in OpenId and "Create a new scope" in OpenId-Module. But I found in that section a list of all other tenants. This was not the default tenant, so I think this should't be. I'm not so happy, that anybody can see all ather tenants than me.

Best regards
David

[Skrypt]

So, basically what you are saying is that from a child tenant you are able to see a list of all tenants from that Scope list.
But normally the Scopes are defined on the Host tenant which is the default tenant. I will need to try and see what you mean exactly. We will need repro steps to decide if it is an actual issue.

[DavidStania]

That is exactly what I mean.

1. Create new Application with default Tenant
2. Create new Tenant
3. Enable OpenID Features for the new Tenant
4. Navigate to Scopes and create new Scope

Now you will see alle Tenants and only the current Tenant is checked with a disabled checkbox.

[Skrypt]

So, as an admin, you have the administrator role which allows you to define these which I think is fine. You may want to create Scopes that access other tenants' data explicitly. This is the advantage to use the OpenAPI module with single sign-on for multiple tenants. So, as an admin, I think it makes sense to be able to do so. Though, if some users on your system can change these settings maybe they should be set in a different role that restricts them to do so.

Now, why would it be an issue for you actually that someone could require access to other tenants' data?

[DavidStania]

In my case, every tenant is a company with his own data, modules and data access. Tenants not known each other. The tenant specific Administrator-User can manage couple of informations behinde the scene - company informations, Api-configurations, subscribe for new modules, manage payment methodes and so on.

I was a bit confused, that this is possible.