Grant type `authorization_code` does not work in OpenIddict 3.0 beta 3

Hi,

I tried to set up my server to support the auth code flow, but it seems to fail with an internal exception when trying to verify the client_id/client_secret combo. I sent the credentials with the HTTP Basic Auth header, but the same error happens when providing the credentials in the request body.

The server logs the following messages:

2020-08-18 13:55:52.6205|INFO|OpenIddict.Server.OpenIddictServerDispatcher|The request address matched a server endpoint: Token.  |url:POST https://localhost/api/auth/token |traceid:|9d8779a6-4ec529eff93391b1. |eventid:|
2020-08-18 13:55:52.6227|INFO|OpenIddict.Server.OpenIddictServerDispatcher|The token request was successfully extracted: {
  "code": "[redacted]",
  "grant_type": "authorization_code",
  "redirect_uri": "custom-scheme://oauth-exchange",
  "client_id": "mobile-client",
  "client_secret": "[redacted]"
}.  |url:POST https://localhost/api/auth/token |traceid:|9d8779a6-4ec529eff93391b1. |eventid:|
2020-08-18 13:55:52.6384|WARN|OpenIddict.Core.OpenIddictApplicationManager|An error occurred while trying to verify a client secret.
This may indicate that the hashed entry is corrupted or malformed. System.FormatException: The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.
   at System.Convert.FromBase64CharPtr(Char* inputPtr, Int32 inputLength)
   at System.Convert.FromBase64String(String s)
   at OpenIddict.Core.OpenIddictApplicationManager`1.<ValidateClientSecretAsync>g__VerifyHashedSecret|56_0(String hash, String secret) in /_/src/OpenIddict.Core/Managers/OpenIddictApplicationManager.cs:line 1426
   at OpenIddict.Core.OpenIddictApplicationManager`1.ValidateClientSecretAsync(String secret, String comparand, CancellationToken cancellationToken) in /_/src/OpenIddict.Core/Managers/OpenIddictApplicationManager.cs:line 1410 |url:POST https://localhost/api/auth/token |traceid:|9d8779a6-4ec529eff93391b1. |eventid:|
2020-08-18 13:55:52.6554|WARN|OpenIddict.Core.OpenIddictApplicationManager|Client authentication failed for mobile-client.  |url:POST https://localhost/api/auth/token |traceid:|9d8779a6-4ec529eff93391b1. |eventid:|
2020-08-18 13:55:52.6562|ERROR|OpenIddict.Server.OpenIddictServerDispatcher|The token request was rejected because the confidential or hybrid application 'mobile-client' didn't specify valid client credentials.  |url:POST https://localhost/api/auth/token |traceid:|9d8779a6-4ec529eff93391b1. |eventid:|
2020-08-18 13:55:52.6579|INFO|OpenIddict.Server.OpenIddictServerDispatcher|The response was successfully returned as a JSON document: {
  "error": "invalid_client",
  "error_description": "The specified client credentials are invalid."
}.  |url:POST https://localhost/api/auth/token |traceid:|9d8779a6-4ec529eff93391b1. |eventid:|

The interesting parts for me is that it logs a successful token request first, and correctly extracts the client_id (and presumably the client_secret), and then after that logs a System.FormatException. It looks like it tries to unpack the auth-header twice, but the second attempt uses invalid data.

[fizker]

I have poked around a bit more, and it looks like the problem was probably that I messed around trying to figure out my client implementation, plus that I got lost when trying to match the stack trace against the OpenIddict code to see when it happened and what I should do to resolve it.

Sorry for the inconvenience.

[kevinchalet]

Roger that. Let’s keep this ticket open until you have a chance to give it another try.