Support for resource indicators

Back in 2017, issue #74 was closed because it was asking for adding support for parameters that were non-standard at the time. Fast forward to today, RFC 8707: Resource Indicators for OAuth 2.0 is a Proposed Standard, making the resource parameter somewhat safe thing to support.

Right now, one can work around it by passing a resource as an additional parameter to the token requests, e.g.:

var response = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
{
    Address = "https://fs.contoso.com/adfs/oauth2/token",
    ClientId = "client",
    ClientSecret = "secret",
    Scope = "scope1",
    Parameters =
    {
        ["resource"] = "https://api.contoso.com",
    },
});

The spec explicitly allows multiple resource values, something that isn’t possible with the custom dictionary right now: “Multiple ‘resource’ parameters MAY be used to indicate that the requested token is intended to be used at multiple resources.” By making the resource an explicit property of the token request, this could be supported as well.

Prominent servers that support, and somewhat even require, this resource parameter are AAD and AD FS, but I hear that other auth servers do have support for this as well. And since this is being standardized, it would make sense to adopt this functionality. I would offer my help in that case too.

[leastprivilege]

I added this for v5. For now there is a workaround.

thanks for reporting.

[leastprivilege]

Good idea. Will look into it.