From 37546248a46c7933a1c84439c0d9d7871d70afd7 Mon Sep 17 00:00:00 2001
From: Brian Kalwat <brian.kalwat@newspring.cc>
Date: Tue, 18 Aug 2026 21:59:17 +0000
Subject: [PATCH] - manually made changes to fix oidc auth block issues with
 20.0.4

---
 RockWeb/Blocks/Security/Oidc/Authorize.ascx    |  2 +-
 RockWeb/Blocks/Security/Oidc/Authorize.ascx.cs | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/RockWeb/Blocks/Security/Oidc/Authorize.ascx b/RockWeb/Blocks/Security/Oidc/Authorize.ascx
index 6e61d1afe40..f0e73c1a742 100644
--- a/RockWeb/Blocks/Security/Oidc/Authorize.ascx
+++ b/RockWeb/Blocks/Security/Oidc/Authorize.ascx
@@ -8,7 +8,7 @@
         <div style="max-width: 360px; margin-left: auto; margin-right: auto;">
             <div class="card">
                 <div class="card-body" style="display: flex; flex-direction: column; gap: var(--spacing-medium); padding: var(--spacing-large);">
-                    <h3 style="text-align: center;">Claude</h3>
+                    <h3 style="text-align: center;">Authorization</h3>
 
                     <p style="text-align: center;">
                         <strong><asp:Literal ID="lNickName" runat="server" />, <asp:Literal ID="lClientName" runat="server" /> is requesting access to your account.</strong>
diff --git a/RockWeb/Blocks/Security/Oidc/Authorize.ascx.cs b/RockWeb/Blocks/Security/Oidc/Authorize.ascx.cs
index 54e9efc0a15..13d4eefbdf3 100644
--- a/RockWeb/Blocks/Security/Oidc/Authorize.ascx.cs
+++ b/RockWeb/Blocks/Security/Oidc/Authorize.ascx.cs
@@ -421,6 +421,17 @@ private void AcceptAuthorization()
                 return;
             }
 
+            // The "openid" scope not a traditional scope. It is used by the
+            // OpenID Connect provider to indicate that the client is
+            // requesting an id_token. Therefore it is safe to add it to the
+            // list of allowed scopes if it was requested without checking if
+            // the client is allowed to request it via the
+            // NarrowRequestedScopesToApprovedScopes() method.
+            if ( requestedScopes.Contains( "openid" ) )
+            {
+                clientAllowedScopes.Add( "openid" );
+            }
+
             // Create a new ClaimsIdentity containing the claims that
             // will be used to create an id_token, a token or a code.
             var identity = RockIdentityHelper.GetRockClaimsIdentity( CurrentUser, clientAllowedClaims, authClient.ClientId );