open-id configuration modifications

[gverstraete]

open-id configuration modifications

[kevinchalet]

Hey,

Is this really the only possible way?

Yes. ASOS will try to "guess" the applicable grant/response types by determining whether the authorization and token endpoints are enabled or not, but if you want to return a more accurate list, using the HandleConfigurationRequest event is the right way to go.

Could we configure it also through startup, and so it maybe also directly get's rejected if a different authorization_code is used?

The original idea was to make these things configurable per-request as much as possible (e.g to support multi-tenancy scenarios with a single ASOS instance).

OpenIddict 3.x - that will replace ASOS when it's officially released - uses a more traditional approach, that requires enabling the flows you want to support at startup. However, developers who need more flexibility will be able to override the validation logic to opt for the same approach ASOS uses.

[gverstraete]

Ok; makes sense! Thanks!