Merge pull request #1287 from smallstep/herman/remove-scope-flag

Add `--remove-scope` flag
smallstep · Oct 2, 2024 · e19cb50 · e19cb50
2 parents d8ddcb6 + 9cbb404
commit e19cb50
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/command/ca/provisioner/provisioner.go b/command/ca/provisioner/provisioner.go
@@ -611,6 +611,11 @@ Use the '--group' flag multiple times to configure multiple groups.`,
 		Name: "scope",
 		Usage: `The <scope> list used to validate the scopes extension in an OpenID Connect token.
 Use the '--scope' flag multiple times to configure multiple scopes.`,
+	}
+	oidcRemoveScopeFlag = cli.StringSliceFlag{
+		Name: "remove-scope",
+		Usage: `Remove the <scope> used to validate the scopes extension in an OpenID Connect token.
+Use the '--remove-scope' flag multiple times to remove multiple scopes.`,
 	}
 	oidcAuthParamFlag = cli.StringSliceFlag{
 		Name: "auth-param",

diff --git a/command/ca/provisioner/update.go b/command/ca/provisioner/update.go
@@ -129,6 +129,7 @@ SCEP
 			oidcGroupFlag,
 			oidcTenantIDFlag,
 			oidcScopeFlag,
+			oidcRemoveScopeFlag,
 			oidcAuthParamFlag,
 
 			// X5C Root Flag