Override OAuth/OIDC scopes

Q&A (please complete the following information)

• OS: Ubuntu 24.04
• Browser: Firefox
• Version: 150.0.1
• Method of installation: standalone
• Swagger-UI version: 5.32.6
• Swagger/OpenAPI version: OpenAPI 3.0.2

Content & configuration

Swagger/OpenAPI definition:

security:
  - entra-id:
    - api.read
    - api.write

components:
  securitySchemes:
    entra-id:
      type: openIdConnect
      openIdConnectUrl: https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration

Swagger-UI configuration options:

ui.initOAuth({
    clientId: "{client-id}",
    scopes: ["openid", "profile", "email", "api.read", "api.write"],
    usePkceWithAuthorizationCodeGrant: true,
  });

Screenshots

How can we help?

Is there a way to force Swagger UI to show checkboxes for scopes not included in the OpenID Connect discovery document's scopes_supported array?

I've configured Swagger to use custom scopes (in addition to standard OpenID Connect scopes), but since Entra (formerly Microsoft Azure AD) doesn't support custom application scopes being returned in the OpenID Connect discovery document, and Swagger UI seems to defer to whatever is returned by the discovery document, the checkboxes available only reflect the standard OIDC claims as a result, ignoring the configured scopes (see screenshot).

Start by tracing the initOAuth configuration and the OpenID Connect discovery response, especially scopes_supported, to see how Swagger UI builds the authorization scope controls. Done means configured custom scopes appear as selectable checkboxes even when the discovery document omits them.