.

Signed-off-by: Jorge Turrado <jorge.turrado@mail.schwarz>

Author: JorTurFer

docs/stackit_auth_login.md

@@ -24,9 +24,9 @@ stackit auth login [flags]
 ### Options
 
 ```
-  -h, --help       Help for "stackit auth login"
-      --port int   The port on which the callback server will listen to. By default, it tries to bind a port between 8000 and 8020.
-                   When a value is specified, it will only try to use the specified port. Valid values are within the range of 8000 to 8020.
+  -h, --help              Help for "stackit auth login"
+      --port int          The port on which the callback server will listen to. By default, it tries to bind a port between 8000 and 8020.
+                          When a value is specified, it will only try to use the specified port. Valid values are within the range of 8000 to 8020.
       --use-device-flow   Use OAuth 2.0 device authorization grant (device flow) instead of the browser callback flow.
 ```
 

internal/pkg/auth/user_login.go

@@ -26,6 +26,7 @@ import (
 const (
 	defaultWellKnownConfig = "https://accounts.stackit.cloud/.well-known/openid-configuration"
 	defaultCLIClientID     = "stackit-cli-0000-0000-000000000001"
+	scope                  = "openid groups offline_access email"
 
 	loginSuccessPath = "/login-successful"
 
@@ -129,7 +130,7 @@ func authorizeUserWithPKCE(p *print.Printer, idpWellKnownConfig *wellKnownConfig
 		Endpoint: oauth2.Endpoint{
 			AuthURL: idpWellKnownConfig.AuthorizationEndpoint,
 		},
-		Scopes:      []string{"openid offline_access email"},
+		Scopes:      []string{scope},
 		RedirectURL: redirectURL,
 	}
 
@@ -360,7 +361,7 @@ type deviceAuthorizationResponse struct {
 func getDeviceAuthorizationData(deviceAuthorizationEndpoint, clientID string) (*deviceAuthorizationResponse, error) {
 	form := url.Values{}
 	form.Set("client_id", clientID)
-	form.Set("scope", "openid offline_access email")
+	form.Set("scope", scope)
 
 	req, err := http.NewRequest("POST", deviceAuthorizationEndpoint, strings.NewReader(form.Encode()))
 	if err != nil {