dotnet / dotnet/aspnetcore

Resource indicators are missing in access token request

Open
#41,176 17 comments 3 reactions 1 assignee Assigned to @blowdart View on GitHub
area-auth
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

The Resource-property set in the OpenIdConnectOptions does not flow through the whole process.

When configuring OpenIdConnect authentication with a resource indication, the resource value is only added to the initial authorization request but not to the subsequent access token request.

### Expected Behavior

When setting the Resource-property the value should be set in subsequent requests and no additional configuration should be needed.
As per [RFC 8707 Section 2.2](https://datatracker.ietf.org/doc/html/rfc8707#section-2.2) the access token request in the 'authorization_code' grant type should also contain the resource indicator.

### Steps To Reproduce

Example configuration:
```c#
builder.Services.AddAuthentication()
.AddOpenIdConnect(options =>
{
options.Authority = "https://localhost:5001/";
options.Resource = "urn:test";

options.Scope.Add("profile");

options.ClientId = "testclient";
options.ClientSecret = "secret";
options.ResponseType = "code";

// workaround:
options.Events = new OpenIdConnectEvents
{
OnAuthorizationCodeReceived = context =>
{
// the resource property here is null but should be set
context.TokenEndpointRequest.Resource = "urn:test";

return Task.FromResult(0);
}
}
};
```

### Exceptions (if any)

_No response_

### .NET Version

6.0.201

### Anything else?

A fix may be applied somewhere around [this line](https://github.com/dotnet/aspnetcore/blob/c85baf8db0c72ae8e68643029d514b2e737c9fae/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L1110).

Something simple like this may already be enough:
```c#
if (Options.Resource != null)
{
tokenEndpointRequest.Resource = Options.Resource;
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.