Include scope in the list of claims - 2025.6.x

[thepipeman]

Context

I want to use the list of scopes and parse it for my security configuration. I have a custom scope "booking:write" which is also added in the list of available scopes in my OAuth2 Provider:

Issue

Now, when a request a token (client_credentials - for a machine-to-machine authn/authz), the claim scope is not included in the JWT.

Request:

curl --location 'http://localhost:9000/application/o/token/' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=openid profile booking:write' \
--data-urlencode 'client_id=_REDUCTED_' \
--data-urlencode 'client_secret=_REDUCTED_'

{
    "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjZlNWM3ZDVjMDUxN2Y5NWJjMmJkNWIyOWFiMmU0ODA2IiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjkwMDAvYXBwbGljYXRpb24vby9jb3JlLXN2Yy1jbGllbnQtYm9va2luZy1zdmMvIiwic3ViIjoiMzMiLCJhdWQiOiJNcWhOdWg0VFloVDE2d3BOaU9DRE53a1VmRE92MGZVMnhxcUxYaHhHIiwiZXhwIjoxNzU2MzA2NzIyLCJpYXQiOjE3NTYzMDMxMjIsImF1dGhfdGltZSI6MTc1NjMwMzEyMiwiYWNyIjoiZ29hdXRoZW50aWsuaW8vcHJvdmlkZXJzL29hdXRoMi9kZWZhdWx0IiwiYm9va2luZ193cml0ZSI6InRydWUiLCJuYW1lIjoiQXV0b2dlbmVyYXRlZCB1c2VyIGZyb20gYXBwbGljYXRpb24gQ29yZSBTZXJ2aWNlIENsaWVudCAtIEJvb2tpbmcgU2VydmljZSAoY2xpZW50IGNyZWRlbnRpYWxzKSIsImdpdmVuX25hbWUiOiJBdXRvZ2VuZXJhdGVkIHVzZXIgZnJvbSBhcHBsaWNhdGlvbiBDb3JlIFNlcnZpY2UgQ2xpZW50IC0gQm9va2luZyBTZXJ2aWNlIChjbGllbnQgY3JlZGVudGlhbHMpIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiYWstY29yZS1zdmMtY2xpZW50LWJvb2tpbmctY2xpZW50X2NyZWRlbnRpYWxzIiwibmlja25hbWUiOiJhay1jb3JlLXN2Yy1jbGllbnQtYm9va2luZy1jbGllbnRfY3JlZGVudGlhbHMiLCJncm91cHMiOltdLCJhenAiOiJNcWhOdWg0VFloVDE2d3BOaU9DRE53a1VmRE92MGZVMnhxcUxYaHhHIiwidWlkIjoic0o5eGppUk1uNG45MkpCNExjcnROU21IejVNM05nSjQ4b05xRmNoaiJ9.hJ06eGn05Ef_FeVc4tYUeUk97i4XkIoPOuNXJb44R2Uia7lo76kpXIOozmyHotgQW2Kn2DCIXVpSiDSQHD755vP0mP6Ad17sXGm62VT3sDaKnuyak2tfkLYU4tbg5_LKPyuC8Jw_ieaSyXL2q_0yB7ESwS2fUn6WfgzOFtbeeegNmBzvvAQzhF7qqZVekh_PBrw8C0JWDtUWz4hQjJuLRRpe7KIQz2ObWBjeNhb9PvPH0D9aecg85xYB4GI-Bovf3n0KO-pmw0lZ4r0VT96I_ZeDJWmcEGB1sMCtD_Niizew24cY9meTfp864TR2TXm4rC4CTclOPAPbuudPG9asof9C4HwN5Nt8qiCOd3yPJW6eb9v_A0mK5-_kXfGCLfCEqWslAIcIAEzEBuelbUcdiBxWoFZ94-TsgN2IKPqyMlnGPqEdPsxyaTes6hKAPWPHF-XMORKQ85lxjBP2rhh4US1aTDwb_mdTdcxqDSN7rhWe7cuquL10XFtAdswOM1WdQK3IcwSk6xwbQd4hXhajYUqW-SGKsV8-LTpaqKEft_qoF43tHwzpq5At2JAyHggeDQjBec0WPrYO6v5OkhiHYh2ndc4R5GWUij8xnkjS0fnrS5q_tFVrc-2_YgIriqXhqIY49AsveuddYE-qCYMluvW8otRGyUYP0KuvnBSxOd8",
    "token_type": "Bearer",
    "scope": "profile openid booking:write",
    "expires_in": 3600,
    "id_token":  _REDUCTED_
}

Decoded JWT

{
  "iss": "http://localhost:9000/application/o/core-svc-client-booking-svc/",
  "sub": "33",
  "aud": "MqhNuh4TYhT16wpNiOCDNwkUfDOv0fU2xqqLXhxG",
  "exp": 1756306722,
  "iat": 1756303122,
  "auth_time": 1756303122,
  "acr": "goauthentik.io/providers/oauth2/default",
  "booking_write": "true",
  "name": "Autogenerated user from application Core Service Client - Booking Service (client credentials)",
  "given_name": "Autogenerated user from application Core Service Client - Booking Service (client credentials)",
  "preferred_username": "ak-core-svc-client-booking-client_credentials",
  "nickname": "ak-core-svc-client-booking-client_credentials",
  "groups": [],
  "azp": "MqhNuh4TYhT16wpNiOCDNwkUfDOv0fU2xqqLXhxG",
  "uid": "sJ9xjiRMn4n92JB4LcrtNSmHz5M3NgJ48oNqFchj"
}

The scope claim is missing.

I have tried exposing a custom claim scope using the following:

return {
    "scope": grant.scopes
}

return {
    "scope": request.context.get("oauth_scopes", [])
}

But nothing works.

Can anyone help me expose scope as a claim?