Resource indicators are missing in access token request
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
The Resource-property set in the OpenIdConnectOptions does not flow through the whole process.
When configuring OpenIdConnect authentication with a resource indication, the resource value is only added to the initial authorization request but not to the subsequent access token request.
### Expected Behavior
When setting the Resource-property the value should be set in subsequent requests and no additional configuration should be needed.
As per [RFC 8707 Section 2.2](https://datatracker.ietf.org/doc/html/rfc8707#section-2.2) the access token request in the 'authorization_code' grant type should also contain the resource indicator.
### Steps To Reproduce
Example configuration:
```c#
builder.Services.AddAuthentication()
.AddOpenIdConnect(options =>
{
options.Authority = "https://localhost:5001/";
options.Resource = "urn:test";
options.Scope.Add("profile");
options.ClientId = "testclient";
options.ClientSecret = "secret";
options.ResponseType = "code";
// workaround:
options.Events = new OpenIdConnectEvents
{
OnAuthorizationCodeReceived = context =>
{
// the resource property here is null but should be set
context.TokenEndpointRequest.Resource = "urn:test";
return Task.FromResult(0);
}
}
};
```
### Exceptions (if any)
_No response_
### .NET Version
6.0.201
### Anything else?
A fix may be applied somewhere around [this line](https://github.com/dotnet/aspnetcore/blob/c85baf8db0c72ae8e68643029d514b2e737c9fae/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L1110).
Something simple like this may already be enough:
```c#
if (Options.Resource != null)
{
tokenEndpointRequest.Resource = Options.Resource;
}
```
Contributor guide
Assessment
This issue has not been assessed yet.