-
Notifications
You must be signed in to change notification settings - Fork 485
Description
The ClientOAuthProvider can manage acr requests to the authorize endpoint via the _additionalAuthorizationParameters but the token endpoint does not support additional parameters.
internal sealed partial class ClientOAuthProvider
{
private readonly IDictionary<string, string> _additionalAuthorizationParameters;
}
...
private Uri BuildAuthorizationUrl(
ProtectedResourceMetadata protectedResourceMetadata,
AuthorizationServerMetadata authServerMetadata,
string codeChallenge)
{
...
foreach (var kvp in _additionalAuthorizationParameters)
{
queryParamsDictionary.Add(kvp.Key, kvp.Value);
}
var queryParams = HttpUtility.ParseQueryString(string.Empty);
foreach (var kvp in queryParamsDictionary)
{
queryParams[kvp.Key] = kvp.Value;
}
var uriBuilder = new UriBuilder(authServerMetadata.AuthorizationEndpoint)
{
Query = queryParams.ToString()
};
BUT IN only the token endpoint is used. No additional params are passed. This is needed for multitenancy support.
private async Task<TokenContainer> ExchangeCodeForTokenAsync(
ProtectedResourceMetadata protectedResourceMetadata,
AuthorizationServerMetadata authServerMetadata,
string authorizationCode,
string codeVerifier,
CancellationToken cancellationToken)
....
using var request = new HttpRequestMessage(HttpMethod.Post, authServerMetadata.TokenEndpoint)
{
Content = requestContent
};
Please see https://www.rfc-editor.org/rfc/rfc6749#section-3.2 for Token Endpoint Spec as it is supported and part of spec.
The endpoint URI MAY include an "application/x-www-form-urlencoded"
formatted (per Appendix B) query component ([RFC3986] Section 3.4),
which MUST be retained when adding additional query parameters. The
endpoint URI MUST NOT include a fragment component.
Can this please be added to ClientOAUthProvider for ExchangeToken and Refresh Token please