title: How to enable openid scope on openshift oauth server?
body: <p>I am trying to make openid/oauth integration with openshift. I need from only authN (validating user identity) - in the end i just need username, and confirmation from some trusted authN provider, nothing else.</p>
  <p>With google or anyone else - when i am requesting openid config to fetch claims and username - ive got good data from endpoints of form <code>https://accounts.google.com/.well-known/openid-configuration</code></p>
  <p>but openshift and documentation says me that i need to navigate to a slightly different route (which is not &quot;well known&quot; to me, from my perspective) - <code>/.well-known/oauth-authorization-server</code>. and navigating to <code>/openid-configuration</code> - returns very little info (looks like its disabled or not fully setup)</p>
  <p>How to enable <code>openid</code> scope on openshift oauth server?</p>
  <p>currently its responding me with incomplete data (from my perspective):</p>
  <pre><code>{
    &quot;issuer&quot;: &quot;https://kubernetes.default.svc&quot;,
    &quot;jwks_uri&quot;: &quot;https://****/openid/v1/jwks&quot;,
    &quot;response_types_supported&quot;: [
      &quot;id_token&quot;
    ],
    &quot;subject_types_supported&quot;: [
      &quot;public&quot;
    ],
    &quot;id_token_signing_alg_values_supported&quot;: [
      &quot;RS256&quot;
    ]
  }
  </code></pre>
  <p>PS</p>
  <p><a href="https://stackoverflow.com/questions/66355485/how-can-i-get-userinfo-from-the-bearer-token-of-redhat-openshift">This one may be related</a>, as an illustration - why for everyone we may use openid+claims, and for openshift I need totally different code path, to use &quot;user:full&quot; scope?</p>
  <p>PS2</p>
  <p><a href="https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest" rel="nofollow noreferrer">here it is stated</a> OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. How to make openshift behave as a standart openid connect provider server? (avoiding working with their userinfo, which is totally in custom format)</p>