What scope is required to be included in a client's request if you wish to...

PingAM 8.0.2 implements OpenID Connect (OIDC) 1.0 as an identity layer on top of the OAuth 2.0 protocol. While OAuth 2.0 is designed for authorization (accessing resources), OIDC is designed for authentication (verifying who the user is).

According to the "OpenID Connect 1.0" documentation in PingAM, the presence of a specific scope in the Authorization Request is what signals to the AM server that the request should be treated as an OIDC flow rather than a standard OAuth2 flow. This mandatory scope isopenid.

When PingAM receives an /oauth2/authorize request containing the scope=openid parameter:

It triggers the OIDC processing logic.

It ensures that anID Token(a signed JWT containing user identity information) is generated alongside (or instead of) the Access Token.

It allows the client to later access theUserInfo Endpointto retrieve further claims about the authenticated user.

Other scopes likeprofile(Option A),email, oraddressare optional OIDC scopes used to request specific sets of user claims, but they do not "activate" OIDC on their own.openid+connectandid(Options B and D) are not recognized standard scopes in the OIDC specification. Therefore,openidis the fundamental requirement for any OIDC interaction in PingAM 8.0.2.