Authorize request should fail if scope request parameter is not provided

[anoopgarlapati]

Closes gh-288

[wsaca]

If this PR is applied, how could we customize the access token to add default scopes? For example, based on the user who was logged in.

[anoopgarlapati]

@wsaca As noted in the issue description #288, authorization server must either reject a request without scope parameter or accept the request with a pre-defined set of scopes. The current behavior provided in the project is neither. As a result this PR will change the default behavior to reject such a request which is what providers such as Okta do.
Also as noted

Ability to customize this default behavior for using a pre-defined value as an alternative behavior suggested in the spec would be provided by custom configuration that would be delivered in #139.

So, the ability to switch this behavior to use a pre-defined value (based on user profile, client profile, etc) would be provided as customization hook in #139.
@jgrandja Can you please chime in here?

[jgrandja]

@wsaca

How could we customize the access token to add default scopes? For example, based on the user who was logged in.

The existing OAuth2TokenCustomizer (gh-199) would allow you to customize the scopes based on the user who was logged in.

See example configuration:

https://github.com/spring-projects-experimental/spring-authorization-server/blob/93d16d4419440be4b89e0ff92ec267bf26db1a02/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationCodeGrantTests.java#L381

[anoopgarlapati]

Closing as this is not needed anymore. See #288 (comment) in the issue.