Implement reference tokens support as an opt-in feature

Objective:

Offering built-in support for reference tokens in OpenIddict, so that things like immediate access token revocation can be easily achieved in OpenIddict-based apps.

Proposed API:

/// <summary>
/// Configures to OpenIddict to use reference tokens, so that authorization codes,
/// access tokens and refresh tokens are stored as ciphertext in the database
/// (only an identifier is returned to the client application). Enabling this option
/// is useful to keep track of all the issued tokens or when storing a very large
/// number of claims in the authorization codes, access tokens and refresh tokens.
/// Note: this option cannot be used when configuring JWT as the access token format.
/// </summary>
/// <param name="builder">The services builder used by OpenIddict to register new services.</param>
/// <returns>The <see cref="OpenIddictBuilder"/>.</returns>
public static OpenIddictBuilder UseReferenceTokens([NotNull] this OpenIddictBuilder builder)
{
    if (builder == null)
    {
        throw new ArgumentNullException(nameof(builder));
    }

    return builder.Configure(options => options.UseReferenceTokens = true);
}

Usage:

public void ConfigureServices(IServiceCollection services)
{
    // Register the OpenIddict services.
    services.AddOpenIddict(options =>
    {
        // ...

        // Configure OpenIddict to use reference tokens.
        options.UseReferenceTokens();
    });
}

Open question: should we have an equivalent to the aspnet-contrib validation middleware for reference tokens, or is the introspection middleware enough for this task?

[kevinchalet]

Does the client id assigned to your resource server match the resource set when calling ticket.SetResources()?

[kevinchalet]

is there any point to use reference id tokens?

It’s not supported (and couldn’t be implemented in a standard way anyway)