From 6829fc1de0a4eb8db68af0586833ac8640462146 Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Wed, 8 Jan 2025 12:21:55 +0100
Subject: [PATCH] clarify that extra_scopes is sometimes non-optional

I am not sure when that happens, but for some providers the offline_access needs to be provided to get refresh_token
---
 lib/galaxy/config/sample/oidc_backends_config.xml.sample | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/galaxy/config/sample/oidc_backends_config.xml.sample b/lib/galaxy/config/sample/oidc_backends_config.xml.sample
index 4244efd5b88..9580d2240f8 100644
--- a/lib/galaxy/config/sample/oidc_backends_config.xml.sample
+++ b/lib/galaxy/config/sample/oidc_backends_config.xml.sample
@@ -13,9 +13,7 @@ Quick Reference
 _______________
 
 - provider:         Sets the name of OpenID Connect (OIDC) Identity Provider (IdP).
-                    The following IdPs are currently supported:
-
-                        { "Google", "Globus" }
+                    Supported providers are listed below in the sample.
 
 - client id:        Sets the id of this client (i.e., your Galaxy instance) with the IdP, which is
                     obtained from the IdP at client registration.
@@ -152,6 +150,9 @@ Please mind `http` and `https`.
         <!-- <pkce_support>false</pkce_support> -->
         <!-- (Optional) the audiences accepted on the access-token for this IDP. -->
         <!-- <accepted_audiences>galaxy</accepted_audiences> -->
+        <!-- (Optional) Extra scopes you need to request for your implementation -->
+        <!-- Please note that offline_access scope can be required to obtain refresh tokens from your provider-->
+        <!-- <extra_scopes>offline_access,something-else</extra_scopes> -->
 
     </provider>
 
@@ -163,6 +164,7 @@ Please mind `http` and `https`.
         <prompt>consent</prompt>
         <icon>https://lifescience-ri.eu/fileadmin/lifescience-ri/media/Images/button-login-small.png</icon>
         <!-- (Optional) Extra scopes you need to request for your implementation -->
+        <!-- Please note that offline_access scope can be required to obtain refresh tokens from your provider-->
         <!-- <extra_scopes>offline_access,something-else</extra_scopes> -->
     </provider>