docs(descope): correct IdP configuration details - #1
Merged
antonsmolyanyy merged 1 commit intoAug 18, 2026
Merged
Conversation
Fact-checked the guide against Descope's current OIDC docs and Pomerium's source, and corrected the following: - Approved Domains: fixed the console path (Security is a sibling of General, under General Settings). Replaced the stated failure mode: Descope skips redirect validation while the list is empty, so the step is optional until a domain is added, at which point api.descope.com must be added too. - Dropped the "login URL" from that step. Pomerium's generic OIDC provider only sends redirect_uri and post_logout_redirect_uri. - idp_scopes: removed the spaces. Pomerium splits the value on "," without trimming, so 'openid, profile' requested a scope named " profile". - Console labels: the Create App dialog is App name / ID / Description, and the picker is the Federated Apps Library. - Removed the duplicated idp_provider, idp_provider_url, idp_client_id and idp_client_secret block from the RBAC section. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Author
|
Hi @antonsmolyanyy, I reviewed your PR and made a few changes to better match Pomerium’s documentation style. Please approve my PR, and then we can move forward. |
Owner
|
@ssveta7ak I approved your PR, thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Corrections to the Descope IdP guide, fact-checked against Descope's current OIDC documentation and Pomerium's source.
Project Settings → General Settings → Security → Approved Domains(Securityis a sibling ofGeneral, not nested under it). Replaced the stated failure mode: Descope skips redirect validation entirely while the list is empty, so the step is optional until you add a domain — at which pointapi.descope.comhas to be added as well, since Descope's own hosted domains aren't allowlisted automatically. The original instructions did not work when tested manually.idp_scopes— removed the spaces from the comma-separated value. Pomerium splits on,without trimming whitespace, so'openid, profile, email'requested scopes literally named" profile"and" email".idp_provider/idp_provider_url/idp_client_id/idp_client_secretblock that was repeated verbatim in the RBAC section; those sections now show only theidp_scopesline that changes.npm run checkpasses locally (format, cspell, reference links, guide audit, robots).Related
Targets the branch behind pomerium#2326.
AI disclosure
Claude Code ran the adversarial fact-check — fetching Descope's docs and reading Pomerium's source to verify each claim — and applied the confirmed fixes. I reviewed every change and hand-edited the prose throughout.
Checklist
🤖 Generated with Claude Code