Ensure that appended roles are unique. Update the documentation.

.traefik.yml

@@ -35,11 +35,8 @@ testData:
   logoutURL: /oauth2/logout # Path for handling logout requests (if not provided, it will be set to callbackURL + "/logout")
   postLogoutRedirectURI: /oidc/different-logout # URL to redirect to after logout (default: "/")
 
-  scopes: # OAuth 2.0 scopes to request (default: ["openid", "email", "profile"])
-    - openid
-    - email
-    - profile
-    - roles # Include this to get role information from the provider
+  scopes: # Additional scopes to append to defaults ["openid", "profile", "email"]
+    - roles # Result: ["openid", "profile", "email", "roles"]
 
   allowedUserDomains: # Restricts access to specific email domains (if not provided, relies on OIDC provider)
     - company.com
@@ -153,11 +150,15 @@ configuration:
   scopes:
     type: array
     description: |
-      The OAuth 2.0 scopes to request from the OIDC provider.
-      Default: ["openid", "profile", "email"]
+      Additional OAuth 2.0 scopes to append to the default scopes.
+      Default scopes are always included: ["openid", "profile", "email"]
+      
+      User-provided scopes are appended to defaults with automatic deduplication.
+      For example, specifying ["roles", "custom_scope"] results in:
+      ["openid", "profile", "email", "roles", "custom_scope"]
 
       Include "roles" or similar scope if you need role/group information.
-      Note: For Google OAuth, the middleware automatically handles the 
+      Note: For Google OAuth, the middleware automatically handles the
       proper authentication parameters and does NOT require the "offline_access"
       scope (which Google rejects as invalid). See documentation for details.
     required: false