openiddict / openiddict-core

Flexible and versatile OAuth 2.0/OpenID Connect stack for .NET
https://openiddict.com/
Apache License 2.0
4.48k stars 528 forks source link

Allow specifying an explicit code challenge method/grant type/response type/response mode per challenge when using `OpenIddictClientService` or the ASP.NET Core/OWIN integrations #2089

Closed kevinchalet closed 5 months ago

kevinchalet commented 5 months ago

Dynamically using a specific code_challenge_method, grant_type, response_type or response_mode was already possible by using a custom event handler, but it wasn't exposed by the ASP.NET Core/OWIN hosts and by OpenIddictClientService.ChallengeInteractivelyAsync(). While it is generally recommended to let OpenIddict negotiate the best code_challenge_method, grant_type, response_type or response_mode itself, this PR now allows configuring these values per challenge without requiring a custom event handler:

var properties = new AuthenticationProperties(new Dictionary<string, string>
{
    // Note: when only one client is registered in the client options,
    // specifying the issuer URI or the provider name is not required.
    [OpenIddictClientAspNetCoreConstants.Properties.ProviderName] = provider,

    // Note: both the grant type and the response type MUST be set when using a specific value:
    [OpenIddictClientAspNetCoreConstants.Properties.GrantType] = GrantTypes.AuthorizationCode,
    [OpenIddictClientAspNetCoreConstants.Properties.ResponseType] = ResponseTypes.Code + ' ' + ResponseTypes.IdToken
})
{
    // Only allow local return URLs to prevent open redirect attacks.
    RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "/"
};

// Ask the OpenIddict client middleware to redirect the user agent to the identity provider.
return Challenge(properties, OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);

This PR also updates the console sandbox to allow using specific grant_type/response_type combinations, making user interactive flows easier to test:

image