Add default scopes fallback for client_credentials/password/token_exchange grants#25356
Merged
Conversation
client_credentials/password/token_exchange grants
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces an opt-in “default scopes” fallback for non-interactive token grants in the OpenIddict ASP.NET Core integration, allowing tokens to inherit the client application’s configured scope permissions when the scope parameter is omitted.
Changes:
- Added
AbpDefaultScopesHandlerto inject default scopes/resources from clientoi_scp:permissions when enabled and no scopes were requested. - Introduced three new opt-in switches on
AbpOpenIddictAspNetCoreOptionsto control the behavior per grant type. - Updated the module to register the new claims principal handler and ensure preconfigured
AbpOpenIddictAspNetCoreOptionsare applied toIOptions.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Claims/AbpDefaultScopesHandler.cs | New handler that applies default client scopes/resources when enabled and request scopes are empty. |
| modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictOptions.cs | Adds three boolean options to enable default-scope fallback for selected grants. |
| modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictAspNetCoreModule.cs | Registers the new handler and ensures preconfigured options flow into IOptions. |
| modules/openiddict/app/OpenIddict.Demo.Server/OpenIddict.Demo.Server.csproj | Adds EF Core Design package reference for the demo server project. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #25356 +/- ##
==========================================
- Coverage 49.33% 49.32% -0.02%
==========================================
Files 3667 3667
Lines 123121 123121
Branches 9404 9404
==========================================
- Hits 60741 60726 -15
- Misses 60557 60571 +14
- Partials 1823 1824 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
… and token_exchange grants
EngincanV
approved these changes
May 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds three opt-in switches on
AbpOpenIddictAspNetCoreOptionsso the access token issued forclient_credentials/password/urn:ietf:params:oauth:grant-type:token-exchangegrants can fall back to the scopes registered on the client (oi_scp:permissions) when the client did not pass ascopeparameter. All default tofalse.UseDefaultScopesForClientCredentialsUseDefaultScopesForPasswordUseDefaultScopesForTokenExchange