OIDC: Standard scopes to determine which claims are returned

[n2ygk]

Fixes #1107

Description of the Change

Only return standard OIDC claims that are permitted by the granted OIDC scopes (profile, email, address, etc.)

Checklist

• PR only contains one change (considered splitting up PR)
• unit-test added
• documentation updated
• CHANGELOG.md updated (only for user relevant changes)
• author name in AUTHORS

[codecov]

Codecov Report

Merging #1108 (8356964) into master (f46439e) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master    #1108   +/-   ##
=======================================
  Coverage   96.61%   96.62%           
=======================================
  Files          32       32           
  Lines        1804     1806    +2     
=======================================
+ Hits         1743     1745    +2     
  Misses         61       61           

Impacted Files	Coverage Δ
oauth2_provider/oauth2_validators.py	93.54% <100.00%> (+0.02%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f46439e...8356964. Read the comment docs.

[n2ygk]

Is the claims parameter actually supported as stated in the docs? Not really. The claims parameter is supported in AuthorizationView and passed upstream to oauthlib but it is not interpreted in any fashion.

The openid-configuration does not assert `"claims_parameter_supported". Per the spec this means it does: "...if omitted, the default value is false."

I will remove the docs reference. Scope-based claims release is probably more than enough functionality improvement at this point.

This implementation is probably better pushed upstream: oauthlib/oauthlib#799 (comment)

[Andrew-Chen-Wang]

Are you still looking to merge upstream and close this?

[n2ygk]

Are you still looking to merge upstream and close this?

Maybe merge here and then look at what upstream stuff can be done and remove this and other stuff that should be upstream later? There's other stuff like oidc metadata that can also potentially go upstream.

[Andrew-Chen-Wang]

sure. lgtm as far as I can tell