Sso lifecycle spec only requests permissions scope