LinkedIn Connector - OAuth 2.0 Deprecated

[GeneMyslinsky]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.
• I am not looking for support or already pursued the available support channels without success.

Version

2.37.0

Storage Type

etcd

Installation Type

Official container image

Expected Behavior

Sign in using linkedin works

Actual Behavior

error=unauthorized_scope_error&error_description=Scope+%26quot%3Br_emailaddress%26quot%3B+is+not+authorized+for+your+application

Steps To Reproduce

1. Create a NEW linkedin OIDC app
2. configure dex with new client_id, secret.
3. Try auth

Additional Information

Sign in with LinkedIn (OAuth2.0) has been deprecated as of Aug 2023. This is the only method supported by the dex connector.

Only LinkedIn apps created after Aug 2023 will be required to use the OIDC flow. While older apps will continue to work using the legacy flow. This probably necessitates a new connector.

Deprecation notice:
https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/sign-in-with-linkedin

Supabase issue:
supabase/auth#1216

The newly supported scopes are:
- "openid"
- "profile"
- "email"

Configuration

No response

Logs

No response

[ahmedabdelkafi1]

I encountered the following error: {'code': 400, 'msg': 'Unsupported provider: Provider linkedin_oidc could not be found'}. Is there a solution available?

[nabokihms]

Since Linkedin is OIDC / OAuth2 compatible, can the generic connector be used?
@ahmedabdelkafi1 @GeneMyslinsky

[bradleybluebean]

The OIDC connector fails, apparently because the issuer is https://www.linkedin.com but the URL for openid-configuration is https://www.linkedin.com/oauth/.well-known/openid-configuration but dex looks for https://www.linkedin.com/.well-known/openid-configuration (which returns a 404)

[nabokihms]

That's a bummer 😔 we can play around it by adding an option to the provider discovery overrides. It sounds like the sane way to play around such providers.