Also, be aware that in future versions, by default, we may not allow the `openid` scope for `password` grant type. The `openid` scope implies that that the user has authorized... which you have not done if you are using the `password` grant type. In fact, you have degraded the user's security by enabling the application to see the user's password (the anti-patter of federated identity).