custom grant_type

[kaputsyn]

Confirm you've already contributed to this project or that you sponsor it

• I confirm I'm a sponsor or a contributor

Version

7

Question

Hi! What is the recommended way to implement custom grant_type? Using IOpenIddictServerHandler<OpenIddictServerEvents.ValidateTokenContext> ? Where can I see the sequence of events to know where to implement customization?

[kevinchalet]

Hey,

What is the recommended way to implement custom grant_type?

If you have simple needs, implementing your custom grant type entirely in your authorization controller - just like how you'd implement other flows like the password flow - is the best and simplest option. You can see an example here: https://stackoverflow.com/a/40260960/542757

If you need to make that grant type reusable in multiple apps (e.g because you're shipping it as an OpenIddict extension), using the events model can indeed be a great option.

Where can I see the sequence of events to know where to implement customization?

For a token request, the invoked events are typically ProcessRequest -> ValidateTokenRequest -> HandleTokenRequest:

• If a positive response is returned (via a sign-in operation): HandleTokenRequest -> ProcessSignIn (during which multiple GenerateToken events are going to be dispatched depending on the types of tokens to return) -> ApplyTokenResponse.
• If an errored response is returned (via challenge operation): HandleTokenRequest -> ProcessChallenge -> ApplyTokenResponse.

If you're specifically interested in the steps performed as part of the ValidateTokenRequest event, the ordered list is here (assuming you're not removing or reordering the built-in event handlers):

openiddict-core/src/OpenIddict.Server/OpenIddictServerHandlers.Exchange.cs

Lines 37 to 65 in 5cf7aad

	/*
	* Token request validation:
	*/
	ValidateGrantType.Descriptor,
	ValidateClientIdParameter.Descriptor,
	ValidateAuthorizationCodeParameter.Descriptor,
	ValidateClientCredentialsParameters.Descriptor,
	ValidateDeviceCodeParameter.Descriptor,
	ValidateRefreshTokenParameter.Descriptor,
	ValidateTokenExchangeParameters.Descriptor,
	ValidateResourceOwnerCredentialsParameters.Descriptor,
	ValidateProofKeyForCodeExchangeParameters.Descriptor,
	ValidateScopeParameter.Descriptor,
	ValidateAudienceParameter.Descriptor,
	ValidateResourceParameter.Descriptor,
	ValidateScopes.Descriptor,
	ValidateAudiences.Descriptor,
	ValidateResources.Descriptor,
	ValidateAuthentication.Descriptor,
	ValidateEndpointPermissions.Descriptor,
	ValidateGrantTypePermissions.Descriptor,
	ValidateScopePermissions.Descriptor,
	ValidateAudiencePermissions.Descriptor,
	ValidateResourcePermissions.Descriptor,
	ValidateProofKeyForCodeExchangeRequirement.Descriptor,
	ValidateAuthorizedParty.Descriptor,
	ValidateRedirectUri.Descriptor,
	ValidateCodeVerifier.Descriptor,
	ValidateGrantedScopes.Descriptor,

Hope it'll help.