How to change validation type in runtime?

Confirm you’ve already contributed to this project or that you sponsor it

• I confirm I’m a sponsor or a contributor

Version

4.x

Question

Hi @kevinchalet 😃 I updated openIdDict to version 4 and I’m trying to use ChangeToken as you said. Unfortunately it doesn’t work, change token is executed but OpenIdDict doesn’t switch between Introspection and Direct. I tried with ChangeToken registered outside AddValidation, the same efect.

services
	.AddOpenIddict()
	.AddCore(options =>
	{
		options.UseEntityFrameworkCore()
			.UseDbContext<ApplicationDbContext>()
			.ReplaceDefaultEntities<Client, Authorization, Scope, Token, int>();
	})
	.AddServer(options =>
	{
		options
			.SetTokenEndpointUris("connect/token")
			.SetRevocationEndpointUris("connect/revocation")
			.SetIntrospectionEndpointUris("connect/introspect");

		options.AddEventHandler<OpenIddictServerEvents.ProcessSignInContext>(builder =>
		{
			builder.UseInlineHandler(context =>
			{
				if (context.Transaction.Request != null)
				{
					context.Response["scope"] = string.Join(" ", context.Transaction.Request.GetScopes().OrderBy(z => z));
				}

				return default;
			});
		});

		options.AddEventHandler<OpenIddictServerEvents.ProcessChallengeContext>(builder =>
		{
			builder.UseInlineHandler(context =>
			{
				var authPropertiesKey = typeof(AuthenticationProperties).ToString();
				if (context.Transaction.Properties.ContainsKey(authPropertiesKey))
				{
					var props = context.Transaction.Properties[authPropertiesKey] as AuthenticationProperties;
					context.Response["message"] = props.Items["message"];
				}

				return default;
			});
		});

		options.AllowClientCredentialsFlow();
		options.AllowPasswordFlow();
		options.AllowRefreshTokenFlow();

		options.UseReferenceRefreshTokens();

		options.RegisterScopes(
			OpenIddictConstants.Permissions.Scopes.Profile.Replace(OpenIddictConstants.Permissions.Prefixes.Scope, string.Empty),
			OpenIddictConstants.Permissions.Scopes.Roles.Replace(OpenIddictConstants.Permissions.Prefixes.Scope, string.Empty),
			CustomScopes.APPLICATION,
			CustomScopes.IDENTITY_SETUP,
			CustomScopes.SUPPORT_PACKAGE);

		options.SetAccessTokenLifetime(TimeSpan.FromHours(1));
		options.SetRefreshTokenLifetime(TimeSpan.FromDays(7));

		options.AddEncryptionCertificate(signingCertificate)
			.AddSigningCertificate(signingCertificate);

		options.DisableAccessTokenEncryption();

		options.UseAspNetCore()
			.EnableTokenEndpointPassthrough();
	})
	.AddValidation(options =>
	{
		SetValidation(options);

		ChangeToken.OnChange(configuration.GetReloadToken, () => SetValidation(options));
	});

SetValidation method

private static void SetValidation(OpenIddictValidationBuilder builder)
{
	MasterUrlManager masterSettings = MasterUrlManager.Get();
	if (!string.IsNullOrWhiteSpace(masterSettings.Host) && masterSettings.Status == MasterStatus.Healthy)
	{
		string clientId = LocalClientManager.GetId();

		builder.SetIssuer($"https://{masterSettings.Host}:{masterSettings.HttpsPort}/");
		builder.AddAudiences(clientId);

		builder.UseIntrospection()
			.SetClientId(clientId)
			.SetClientSecret(LocalClientManager.GetSecret());

		builder.UseSystemNetHttp();
	}
	else
	{
		builder.UseLocalServer();
	}

	builder.UseAspNetCore();
}

[kevinchalet]

Note: it’s absolutely not specific to OpenIddict, so you can use the same approach with any other library that uses Microsoft.Extensions.Options.

[kevinchalet]

Awesome! 👍🏻

Thanks again for sponsoring the project, much appreciated ❤️