Generic OIDC group scope is not sent in the request formed by the UI

[gaktive]

Internal reference: SURE-9143
Reported in 2.9.2

Issue description:
Despite adding the "groups" scope in the OIDC config, the request that is generated is not including the "groups" scope.

Repro steps:
OIDC configured and checked the generated request.

Workaround:
None

Actual behavior:
The request does not contain the group scope despite being configured.

Expected behavior:
Expect the generated request to contain the group scope.

@mantis-toboggan-md was able to reproduce this issue and confirm it is a UI bug:

The UI ignores configured scopes and always uses the values configured here https://github.com/rancher/dashboard/blob/master/shell/store/auth.js#L16. Likely, we need to update the redirectTo method in that file to fetch the genericoidc authconfig object and use its scope field to construct the redirect url, instead of that list of defaults.

[gaktive]

/backport v2.10.1

[cnotv]

@mantis-toboggan-md I see no mention of groups whatsoever in the whole store or auth util, is it missing or?

[cnotv]

Thanks @mantis-toboggan-md for clarifying in chat.
For the records, we talk about the scopes on this page to not be honored when generating a redirect URL:

[cnotv]

Just for the record, we will write a lot of unit tests for this process, as there are none, given that it's an old code.
This seems to cover:

• View
• State, several parts
• Shared logic (mixin)

[cnotv]

Pushing to v2.12.0 as I have to prioritize SCC

[cnotv]

@gaktive looks like we have still time for the remaining development of SCC. Also I've finally identified the issue with the help of @mantis-toboggan-md

Setting back milestone to 2.11.0.

[cnotv]

After finally managing to add scopes to the URL, it seems some kind of validation is preventing us to achieve the requirements.

Query parameters with default scopes: scope=openid%20profile%20email
Query parameters with scopes from UI: scope=openid%20profile%20email%20group

Need to investigate this new issue.
The origin of this validation is unclear, as in the network all the requests have status 200.

[cnotv]

For the record: Scopes must also be added to the clientID group configuration or that error is returned from the redirect authentication.

[cnotv]

/backport v2.9.8

[IsaSih]

Validated in
Rancher | v2.11-94853c35bd1e02cf8aa114be4016bc3699288c6a-head
Dashboard | master 9b894b4
Rancher CLI | v2.11.0-rc.1

The formed URL from Rancher to the Auth Provider includes all of the scopes