Resource indicators are missing in access token request #41176
Description
Is there an existing issue for this?
- I have searched the existing issues
Describe the bug
The Resource-property set in the OpenIdConnectOptions does not flow through the whole process.
When configuring OpenIdConnect authentication with a resource indication, the resource value is only added to the initial authorization request but not to the subsequent access token request.
Expected Behavior
When setting the Resource-property the value should be set in subsequent requests and no additional configuration should be needed.
As per RFC 8707 Section 2.2 the access token request in the 'authorization_code' grant type should also contain the resource indicator.
Steps To Reproduce
Example configuration:
builder.Services.AddAuthentication()
.AddOpenIdConnect(options =>
{
options.Authority = "https://localhost:5001/";
options.Resource = "urn:test";
options.Scope.Add("profile");
options.ClientId = "testclient";
options.ClientSecret = "secret";
options.ResponseType = "code";
// workaround:
options.Events = new OpenIdConnectEvents
{
OnAuthorizationCodeReceived = context =>
{
// the resource property here is null but should be set
context.TokenEndpointRequest.Resource = "urn:test";
return Task.FromResult(0);
}
}
};Exceptions (if any)
No response
.NET Version
6.0.201
Anything else?
A fix may be applied somewhere around this line.
Something simple like this may already be enough:
if (Options.Resource != null)
{
tokenEndpointRequest.Resource = Options.Resource;
}