Allow to hide client scopes from scopes_supported in discovery endpoint #10388

Activity

1. cgeorgilakis

   added

   kind/enhancementCategorizes a PR related to an enhancementCategorizes a PR related to an enhancement

   status/triage

   on Feb 22, 2022
2. stianst

   added the

   enhancement

   issue type on Oct 2, 2025
3. remcojansen commented on Oct 22, 2025

   

   remcojansen

   on Oct 22, 2025

   More actions

   In our project we have a similar requirement and I am keen on helping to complete this feature. That said, we are migrating from a different product in which scopes are classified in two categories:

   1. scopes that are available by default to all clients and advertised in the discovery document and
   2. scopes that are available only to clients when explicitly assigned and not advertised in the discovery document.

   This seems similar to how scopes can be assigned on realm level versus client level in Keycloak.

   With this in mind, I would prefer to also (or instead) have the option of hiding all scopes that are only assigned on client level (i.e. where type == none on realm level) from the discovery document. Wdyt?
4. cgeorgilakis commented on Oct 22, 2025

   

   cgeorgilakis

   on Oct 22, 2025

   ContributorAuthor

   More actions

   In our project we have a similar requirement and I am keen on helping to complete this feature. That said, we are migrating from a different product in which scopes are classified in two categories:

   1. scopes that are available by default to all clients and advertised in the discovery document and
   2. scopes that are available only to clients when explicitly assigned and not advertised in the discovery document.

   This seems similar to how scopes can be assigned on realm level versus client level in Keycloak.

   With this in mind, I would prefer to also (or instead) have the option of hiding all scopes that are only assigned on client level (i.e. where type == none on realm level) from the discovery document. Wdyt?

   Do not confuse settings. type == none is for not being default scope in new creating clients.
   I have proposed hideFromOpenIDProviderMetadata field for this.
   My PR needs to be rebased and opened again. @remcojansen @manusa
5. manusa commented on Oct 22, 2025

   

   manusa

   on Oct 22, 2025

   Last edited by manusa

   Contributor

   More actions

   For more context, this is currently required to make kubernetes-mcp-server work with VSCode and DCR.

   The solution we have at the moment is to overwrite the response when proxying the request to the keycloak server:

   https://github.com/containers/kubernetes-mcp-server/blob/49afbad502e5d97248f3c0d4b7b324311a91d021/pkg/http/wellknown.go#L71-L77
6. 10 remaining items

   Load more
7. ahus1

   added a commit that references this issue on Nov 3, 2025

   hide scopes from scopes_supported in discovery endpoint

   ...

   This issue will close once commit ab35b09 is merged into the 'main' branch.

   ab35b09
8. ahus1

   self-assigned this

   on Nov 3, 2025
9. ahus1

   added a commit that references this issue on Nov 4, 2025

   hide scopes from scopes_supported in discovery endpoint

   ...

   This issue will close once commit d8055ac is merged into the 'main' branch.

   d8055ac
10. github-actions

    added

    release/26.4.4

    and removed

    backport/26.4

    on Nov 4, 2025
11. keycloak-github-bot

    added

    team/production-readiness

    team/cloud-native

    team/continuous-delivery

    team/core-shared

    team/core-iam

    team/core-clients

    team/community

    team/core-protocols

    team/core-authn

    team/security

    on Aug 20, 2026