Merge pull request #1287 from smallstep/herman/remove-scope-flag

Add `--remove-scope` flag

Author: hslatman

command/ca/provisioner/provisioner.go

@@ -611,6 +611,11 @@ Use the '--group' flag multiple times to configure multiple groups.`,
 		Name: "scope",
 		Usage: `The <scope> list used to validate the scopes extension in an OpenID Connect token.
 Use the '--scope' flag multiple times to configure multiple scopes.`,
+	}
+	oidcRemoveScopeFlag = cli.StringSliceFlag{
+		Name: "remove-scope",
+		Usage: `Remove the <scope> used to validate the scopes extension in an OpenID Connect token.
+Use the '--remove-scope' flag multiple times to remove multiple scopes.`,
 	}
 	oidcAuthParamFlag = cli.StringSliceFlag{
 		Name: "auth-param",

command/ca/provisioner/update.go

@@ -129,6 +129,7 @@ SCEP
 			oidcGroupFlag,
 			oidcTenantIDFlag,
 			oidcScopeFlag,
+			oidcRemoveScopeFlag,
 			oidcAuthParamFlag,
 
 			// X5C Root Flag