# Brokering an OAuth 2.0 identity **URL:** \ **Category:** Getting advice\ **Tags:** identity-brokering, oidc\ **Created:** [June 12, 2023, 5:16pm UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625 "2023-06-12T17:16:46Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![nidhiraj98](https://avatars.discourse-cdn.com/v4/letter/n/e79b87/32.png) [@nidhiraj98](https://forum.keycloak.org/u/nidhiraj98)\ **Post date:** [June 12, 2023, 5:16pm UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/1 "2023-06-12T17:16:46Z")
Hi there, I am trying to add [Amazon Login](https://developer.amazon.com/apps-and-games/login-with-amazon) as an Identity Provider in my Keycloak application deployed on AWS. Login with Amazon (LWA) is an OAuth 2.0 IdP. I tried setting it up as an OIDC IdP. However, LWA throws an error calling out “openid” as an invalid scope. Is there any way to add a custom OAuth 2.0 IdP? Thanks! ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [June 12, 2023, 5:35pm UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/2 "2023-06-12T17:35:02Z")
Can you post your full config? You can customize the `scopes` that get sent in the _Advanced_ section of the IdP setup. ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [June 12, 2023, 5:36pm UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/3 "2023-06-12T17:36:24Z")
Looks like the supported scopes are: > REQUIRED. The scope of the request. Must be profile, profile:user\_id, postal\_code, or some combination, separated by spaces (e.g. profile%20postal\_code). For more information, see Customer Profile. > **[Authorization Code Grant | Login with Amazon](https://developer.amazon.com/docs/login-with-amazon/authorization-code-grant.html)** > > An Authorization Code grant allows a client (typically a website) to direct the user-agent (a user's browser) to a URI at Amazon. The user is then presented with a page asking t... ---
**Author:** ![nidhiraj98](https://avatars.discourse-cdn.com/v4/letter/n/e79b87/32.png) [@nidhiraj98](https://forum.keycloak.org/u/nidhiraj98)\ **Post date:** [June 13, 2023, 5:39am UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/4 "2023-06-13T05:39:31Z")
So I’ve chosen “OpenID Connect v1” in the Add Provider dropdown in Identity Providers tab. Filled in the following details: Authorization URL: [https://www.amazon.com/ap/oa](https://www.amazon.com/ap/oa) Token URL: [https://api.amazon.com/auth/o2/token](https://api.amazon.com/auth/o2/token) Client Authentication: Client secret sent as post Client ID: \ Client Secret: \ Default Scopes: profile Even after setting the default scope as “profile”, I still see the login request sent with the scope param as “openid+profile”. I don’t seem to find the “Advanced” section on the Admin console. Could you please let me know where that is? Thanks! ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [June 13, 2023, 5:24pm UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/5 "2023-06-13T17:24:57Z")
Scroll down and there is an **Advanced** link to open an additional section. ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/0/016182c24f489e9196a47c10000a07da02843fa3.png) ---
**Author:** ![nidhiraj98](https://avatars.discourse-cdn.com/v4/letter/n/e79b87/32.png) [@nidhiraj98](https://forum.keycloak.org/u/nidhiraj98)\ **Post date:** [June 14, 2023, 1:28am UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/6 "2023-06-14T01:28:35Z")
After configuring the scope here as “profile”, I see that the scope in the auth request is still set to “openid+profile”. I would like it to be set to only “profile”. Is there any way to configure this? ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [June 14, 2023, 7:38am UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/7 "2023-06-14T07:38:47Z")
Looks like the code adds `openid` by default. I don’t know a way to remove it. ---
**Author:** ![jblachly](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jblachly/32/6657_2.png) [@jblachly](https://forum.keycloak.org/u/jblachly)\ **Post date:** [June 17, 2023, 9:41pm UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/8 "2023-06-17T21:41:29Z")
Seems like a reasonable request. I recommend you file an issue for this; include a link here as Login with Amazon should be a motivating example. ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [June 18, 2023, 7:59am UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/9 "2023-06-18T07:59:08Z")
The Keycloak IdP configuration is about OIDC, Amazon is an OAuth 2 IdP… Although the former is based on the latter, it’s two different things. For doing OIDC, the scope `openid` is required; without, it’s just plain OAuth2. And, to repeat myself, Keycloak is doing OIDC here, not OAuth2. 🤷‍♂️ ---
**Author:** ![nidhiraj98](https://avatars.discourse-cdn.com/v4/letter/n/e79b87/32.png) [@nidhiraj98](https://forum.keycloak.org/u/nidhiraj98)\ **Post date:** [June 18, 2023, 12:45pm UTC](https://forum.keycloak.org/t/brokering-an-oauth-2-0-identity/22625/10 "2023-06-18T12:45:28Z")
Agreed. However, I believe having a generic IdP configuration for OAuth 2.0 would be better. Looks like Keycloak already supports OAuth 2.0, but not a generic page to configure the provider. The configurations are specific to individual social providers. Currently, I’ve resolved this by implementing Keycloak’s SocialIdentityProvider interface and placed it as a Java JAR in ${keycloak.home.dir}/providers. [https://www.keycloak.org/docs/latest/server\_development/#\_providers](https://www.keycloak.org/docs/latest/server_development/#_providers)