400 in the oauth2 proxy when a user doesn’t submit scope

[Richa15]

I want to check in apigee edge if no scope is passed in the token request how can I raise fault and add it to the flow? I am new to apigee edge any help would be appreciated thanks

[dchiesa1]

According to RFC 6749, which defines OAuth V2.0, both the authorization and the token endpoints accept an optional scope parameter.

The authorization endpoint is a GET request, the token endpoint accepts a POST request. The spec says that for the authorization endpoint, the scope param should be a query parameter. The spec does not suggest how to pass the scope param into the token endpoint, but since the spec does say that all the other required and optional parameters sent into the token endpoint are form parameters, it would make sense for the optional scope to also be a form parameter in the token request.

You said

if no scope is passed in the token request how can I raise fault and add it to the flow?

...so I'm assuming that the request you're talking about is to the token endpoint, hence the scope param would be a form parameter.

Therefore you need something like this in your flow:

<Step>
  <Condition>request.formparam.scope = null</Condition>
  <Name>RF-Invalid-Request</Name>
</Step>
<Step>
  <Name>OAuthV2-GenerateAccessToken</Name>
</Step>

[Richa15]

According, to what you suggested I would like to add that my business requirement is a bit different where we source our tokens from okra and scopes are technically required so we should get an error if they don’t request any. So, according to this how should I raise fault and can I use request.content to check in the token flow?

[dchiesa1]

I don't know.  I dont know how you have Okta connected to your Apigee. I don't know what the requests look like.  

So the best I can do without further details is give you a general answer: Depending on where the "scope" parameter is expected, you can check different things and use different syntax in the Condition in Apigee.