Allow specifying an explicit code challenge method/grant type/response type/response mode per challenge when using `OpenIddictClientService` or the ASP.NET Core/OWIN integrations #2089
Dynamically using a specific code_challenge_method, grant_type, response_type or response_mode was already possible by using a custom event handler, but it wasn't exposed by the ASP.NET Core/OWIN hosts and by OpenIddictClientService.ChallengeInteractivelyAsync(). While it is generally recommended to let OpenIddict negotiate the best code_challenge_method, grant_type, response_type or response_mode itself, this PR now allows configuring these values per challenge without requiring a custom event handler:
var properties = new AuthenticationProperties(new Dictionary<string, string>
{
// Note: when only one client is registered in the client options,
// specifying the issuer URI or the provider name is not required.
[OpenIddictClientAspNetCoreConstants.Properties.ProviderName] = provider,
// Note: both the grant type and the response type MUST be set when using a specific value:
[OpenIddictClientAspNetCoreConstants.Properties.GrantType] = GrantTypes.AuthorizationCode,
[OpenIddictClientAspNetCoreConstants.Properties.ResponseType] = ResponseTypes.Code + ' ' + ResponseTypes.IdToken
})
{
// Only allow local return URLs to prevent open redirect attacks.
RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "/"
};
// Ask the OpenIddict client middleware to redirect the user agent to the identity provider.
return Challenge(properties, OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);
This PR also updates the console sandbox to allow using specific grant_type/response_type combinations, making user interactive flows easier to test:
Dynamically using a specific
code_challenge_method
,grant_type
,response_type
orresponse_mode
was already possible by using a custom event handler, but it wasn't exposed by the ASP.NET Core/OWIN hosts and byOpenIddictClientService.ChallengeInteractivelyAsync()
. While it is generally recommended to let OpenIddict negotiate the bestcode_challenge_method
,grant_type
,response_type
orresponse_mode
itself, this PR now allows configuring these values per challenge without requiring a custom event handler:This PR also updates the console sandbox to allow using specific
grant_type
/response_type
combinations, making user interactive flows easier to test: