- Remove 'roles' from default oauthConfig scope
- Roles scope is not registered in OpenIddict
- This was causing 403 Forbidden when requesting access token
- Remove 'roles' from .env.development and .env.production
- Remove 'roles' from SeedData.cs
- 403 error was caused by requesting unregistered scope
- All registered scopes: openid, profile, email, api, offline_access
Design document for integrating Vben Admin with Fengling.AuthService using OAuth2 Authorization Code flow with PKCE.
Key features:
- OAuth2 Authorization Code flow with PKCE
- JWT token management with automatic refresh
- Single Logout (SLO) support
- Multi-tenant and RBAC support via claims
- Full error handling and security considerations
- Modify login page to auto-redirect to auth center
- Update auth store to use OAuth login flow
- Handle OAuth callback and token exchange
- Update logout to use OAuth logout endpoint