Passing ACR_VALUES TO Token Endpoint

The ClientOAuthProvider can manage acr requests to the authorize endpoint via the _additionalAuthorizationParameters but the token endpoint does not support additional parameters.

internal sealed partial class ClientOAuthProvider
{
    private readonly IDictionary<string, string> _additionalAuthorizationParameters;
}
...
 private Uri BuildAuthorizationUrl(
     ProtectedResourceMetadata protectedResourceMetadata,
     AuthorizationServerMetadata authServerMetadata,
     string codeChallenge)
{
...
foreach (var kvp in _additionalAuthorizationParameters)
{
    queryParamsDictionary.Add(kvp.Key, kvp.Value);
}

var queryParams = HttpUtility.ParseQueryString(string.Empty);
foreach (var kvp in queryParamsDictionary)
{
    queryParams[kvp.Key] = kvp.Value;
}

var uriBuilder = new UriBuilder(authServerMetadata.AuthorizationEndpoint)
{
    Query = queryParams.ToString()
};

BUT IN only the token endpoint is used. No additional params are passed. This is needed for multitenancy support.

 private async Task<TokenContainer> ExchangeCodeForTokenAsync(
     ProtectedResourceMetadata protectedResourceMetadata,
     AuthorizationServerMetadata authServerMetadata,
     string authorizationCode,
     string codeVerifier,
     CancellationToken cancellationToken)
....
 using var request = new HttpRequestMessage(HttpMethod.Post, authServerMetadata.TokenEndpoint)
 {
     Content = requestContent
 };

Please see https://www.rfc-editor.org/rfc/rfc6749#section-3.2 for Token Endpoint Spec as it is supported and part of spec.

The endpoint URI MAY include an "application/x-www-form-urlencoded"
formatted (per Appendix B) query component ([RFC3986] Section 3.4),
which MUST be retained when adding additional query parameters. The
endpoint URI MUST NOT include a fragment component.

Can this please be added to ClientOAUthProvider for ExchangeToken and Refresh Token please

Inizia da ClientOAuthProvider, in particolare da ExchangeCodeForTokenAsync e dalla gestione esistente di _additionalAuthorizationParameters in BuildAuthorizationUrl. Segui il modo in cui vengono costruite le richieste di token e di refresh, quindi esamina i test circostanti, se presenti. Il lavoro è completato quando i parametri aggiuntivi richiesti sono supportati sia per lo scambio del token sia per il refresh, preservando il comportamento degli endpoint descritto in RFC 6749.