Readme: suggest openid and profile as scopes for Keycloak.

README.rst

@@ -234,13 +234,19 @@ Setup Plone as a client
 
   * ``Use deprecated redirect_uri for logout url(/Plone/acl_users/oidc/logout)`` checked. Use this if you need to run old versions of Keycloak.
 
-    **Tip:** Leave the rest at the defaults, unless you know what you are doing.
+  * ``Open ID scopes to request to the server``: this depends on which version of Keycloak you are using, and which scopes are available there.
+    In recent Keycloak versions, you *must* include ``openid`` as scope.
+    Suggestion is to use ``openid`` and ``profile``.
+
+  *  **Tip:** Leave the rest at the defaults, unless you know what you are doing.
 
   * Click ``Save``.
 
 **Plone is ready done configured!**
 
-[TODO] screenshot.
+See this screenshot:
+
+.. image:: docs/screenshot-settings.png
 
 *Warning:*
 
@@ -358,4 +364,4 @@ The project is licensed under the GPLv2.
 
 .. _`collective.regenv`: https://pypi.org/project/collective.regenv/
 .. _`Products.mcdutils`: https://pypi.org/project/Products.mcdutils/
-.. _PKCE: https://datatracker.ietf.org/doc/html/rfc7636
+.. _PKCE: https://datatracker.ietf.org/doc/html/rfc7636

setup.cfg

@@ -1,9 +1,12 @@
 [check-manifest]
 ignore =
     *.cfg
+    *.txt
     .coveragerc
     .editorconfig
     .gitattributes
+    .gitlab-ci.yml
+    tox.ini
 
 [isort]
 # black compatible isort rules: