Make 'scopes' optional in oauth2clientcredentials middleware

[anschoewe]

In what area(s)?

/area runtime

/area operator

/area placement

/area docs

/area test-and-release

Describe the feature

Not all OAuth2 token issuers require scopes during the client_credential token exchange. For example, Auth0 does not accept 'scopes'.

Therefore, I believe 'scopes' should be optional in the oauth2clientcredentials middleware component. It's currently required to have a value.

Release Note

oauth2clientcredentials now supports optional scopes, making it compatible with token issuer's like Auth0.

RELEASE NOTE:

[berndverst]

Are you able to configure Auth0 using an empty value for the scopes today?

[anschoewe]

Yes. I’ve been using it for years without specifying a scope. By that I mean I don’t even pass the key “scopes” in the request. Totally absent.