Investigate OpenIddict 4.0.

[maliming]

https://kevinchalet.com/2022/06/22/openiddict-4-0-preview1-is-out/

[kevinchalet]

FYI, there'll be a breaking change in 4.0: the AddClaim overloads taking a destinations parameter will be removed. A quick search shows that 2 places seem to use these extensions:

• abp/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.ClientCredentials.cs

  Lines 34 to 38 in 60e55d6

  	identity.AddClaim(OpenIddictConstants.Claims.Subject, await ApplicationManager.GetClientIdAsync(application),
  	OpenIddictConstants.Destinations.AccessToken, OpenIddictConstants.Destinations.IdentityToken);
  	identity.AddClaim(OpenIddictConstants.Claims.PreferredUsername, await ApplicationManager.GetDisplayNameAsync(application),
  	OpenIddictConstants.Destinations.AccessToken, OpenIddictConstants.Destinations.IdentityToken);

• abp/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/OpenIddictClaimsPrincipalContributor.cs

  Line 39 in 60e55d6

  identity.AddClaim(OpenIddictConstants.Claims.ClientId, clientId, OpenIddictConstants.Destinations.AccessToken);

In the first case, the destinations can be safely removed because they are always set later anyway in the foreach block (and claim.SetDestinations() will still be present in 4.0):

abp/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.ClientCredentials.cs

Lines 54 to 57 in 60e55d6

	foreach (var claim in principal.Claims)
	{
	claim.SetDestinations(GetDestinations(claim));
	}

In the second case, I'm not sure why this code exists as OpenIddict always adds a client_id claim to all the access tokens it creates: https://github.com/openiddict/openiddict-core/blob/3.1.1/src/OpenIddict.Server/OpenIddictServerHandlers.cs#L2011-L2013. It's likely this part could be removed too.

[maliming]

Thanks @kevinchalet I will check your comments. 👍

[leonkosak]

@maliming, is "valid issuers" property still relevant in OpenIddict?
IDS4 theme for valid issuers: #5589

[maliming]

hi @leonkosak

I think you can configue the TokenValidationParameters of OpenIddictValidationOptions.

It's same logic.

[hikalkan]

Moved to #14483