Skip to content

Use one switch for legacy OAuth grant compatibility #1747

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
StuartFerguson merged 4 commits into from
Oct 7, 2026
Merged

Use one switch for legacy OAuth grant compatibility #1747

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1a628f9
Gate legacy password grant with compatibility switch
StuartFerguson Oct 7, 2026
36ac4fa
Use one legacy grant compatibility switch
StuartFerguson Oct 7, 2026
6249914
Merge branch 'main' into feature/#1725_initial_mfa_support
StuartFerguson Oct 7, 2026
f85f945
Gate implicit flow with legacy grant switch
StuartFerguson Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion SecurityService.BusinessLogic/Oidc/OAuthGrantPolicy.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ public static bool IsGrantAllowed(string grantType, string clientId, OAuthOption
return true;
}

if (string.Equals(grantType, "hybrid", StringComparison.OrdinalIgnoreCase) && options.EnableHybridFlow == false)
if (LegacyGrantTypes.Contains(grantType) && options.EnableLegacyGrantTypes == false)
{
return false;
}
Expand Down
2 changes: 1 addition & 1 deletion SecurityService.BusinessLogic/SecurityServiceOptions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ public ServiceOptions()

public sealed class OAuthOptions
{
public bool EnableHybridFlow { get; set; }
public bool EnableLegacyGrantTypes { get; set; } = true;

public Dictionary<string, List<string>> LegacyGrantTypeClients { get; set; } = new(StringComparer.OrdinalIgnoreCase);
}
Expand Down
2 changes: 1 addition & 1 deletion SecurityService.IntegrationTests/Common/DockerHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ public override ContainerBuilder SetupSecurityServiceContainer()
environmentVariables.Add("ServiceOptions:ManagementBootstrap:ClientSecret", "management-bootstrap-secret");
environmentVariables.Add("ServiceOptions:OAuth:LegacyGrantTypeClients:password:0", "merchantClient");
environmentVariables.Add("ServiceOptions:OAuth:LegacyGrantTypeClients:hybrid:0", "testclient2");
environmentVariables.Add("ServiceOptions:OAuth:EnableHybridFlow", "true");
environmentVariables.Add("ServiceOptions:OAuth:EnableLegacyGrantTypes", "true");
environmentVariables.Add("ConnectionStrings:PersistedGrantDbContext", this.SetConnectionString($"PersistedGrantStore-{this.TestId}", this.UseSecureSqlServerDatabase));
environmentVariables.Add("ConnectionStrings:ConfigurationDbContext", this.SetConnectionString($"Configuration-{this.TestId}", this.UseSecureSqlServerDatabase));
environmentVariables.Add("ConnectionStrings:AuthenticationDbContext", this.SetConnectionString($"Authentication-{this.TestId}", this.UseSecureSqlServerDatabase));
Expand Down
21 changes: 19 additions & 2 deletions SecurityService.UnitTests/Oidc/OAuthGrantPolicyTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ public void HybridFlow_IsRejectedWhenFeatureIsDisabled()
{
var options = new OAuthOptions
{
EnableHybridFlow = false,
EnableLegacyGrantTypes = false,
LegacyGrantTypeClients = new(StringComparer.OrdinalIgnoreCase)
{
["hybrid"] = ["browser-client"]
Expand All @@ -69,12 +69,29 @@ public void HybridFlow_IsRejectedWhenFeatureIsDisabled()
OAuthGrantPolicy.IsGrantAllowed("hybrid", "browser-client", options).ShouldBeFalse();
}

[Fact]
public void LegacyGrantTypes_AreRejectedWhenCompatibilitySwitchIsDisabled()
{
var options = new OAuthOptions
{
EnableLegacyGrantTypes = false,
LegacyGrantTypeClients = new(StringComparer.OrdinalIgnoreCase)
{
[GrantTypes.Password] = ["mobile-client"],
["hybrid"] = ["browser-client"]
}
};

OAuthGrantPolicy.IsGrantAllowed(GrantTypes.Password, "mobile-client", options).ShouldBeFalse();
OAuthGrantPolicy.IsGrantAllowed("hybrid", "browser-client", options).ShouldBeFalse();
}

[Fact]
public void HybridFlow_IsAllowedForConfiguredClientWhenFeatureIsEnabled()
{
var options = new OAuthOptions
{
EnableHybridFlow = true,
EnableLegacyGrantTypes = true,
LegacyGrantTypeClients = new(StringComparer.OrdinalIgnoreCase)
{
["hybrid"] = ["browser-client"]
Expand Down
7 changes: 5 additions & 2 deletions SecurityService/HostedServices/DatabaseInitializer.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,10 +85,13 @@ private async Task SynchronizeApplicationPermissionsAsync(IServiceProvider servi
await applicationManager.PopulateAsync(descriptor, application, cancellationToken);

IReadOnlyCollection<string> allowedGrantTypes = JsonListSerializer.Deserialize(client.AllowedGrantTypesJson);
if (this.Options.OAuth.EnableHybridFlow == false)
if (this.Options.OAuth.EnableLegacyGrantTypes == false)
{
allowedGrantTypes = allowedGrantTypes
.Where(grantType => string.Equals(grantType, "hybrid", StringComparison.OrdinalIgnoreCase) == false)
.Where(grantType =>
string.Equals(grantType, "password", StringComparison.OrdinalIgnoreCase) == false &&
string.Equals(grantType, "implicit", StringComparison.OrdinalIgnoreCase) == false &&
string.Equals(grantType, "hybrid", StringComparison.OrdinalIgnoreCase) == false)
.ToArray();
}

Expand Down
10 changes: 7 additions & 3 deletions SecurityService/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,17 +304,21 @@
.AllowClientCredentialsFlow()
.AllowRefreshTokenFlow();

if (options.OAuth.LegacyGrantTypeClients.TryGetValue(OpenIddictConstants.GrantTypes.Password, out List<string>? passwordClients) && passwordClients.Count > 0)
if (options.OAuth.EnableLegacyGrantTypes &&
Comment thread
StuartFerguson marked this conversation as resolved.
Resolved
options.OAuth.LegacyGrantTypeClients.TryGetValue(OpenIddictConstants.GrantTypes.Password, out List<string>? passwordClients) &&
passwordClients.Count > 0)
{
serverOptions.AllowPasswordFlow();
}

if (options.OAuth.LegacyGrantTypeClients.TryGetValue(OpenIddictConstants.GrantTypes.Implicit, out List<string>? implicitClients) && implicitClients.Count > 0)
if (options.OAuth.EnableLegacyGrantTypes &&
options.OAuth.LegacyGrantTypeClients.TryGetValue(OpenIddictConstants.GrantTypes.Implicit, out List<string>? implicitClients) &&
implicitClients.Count > 0)
{
serverOptions.AllowImplicitFlow();
}

if (options.OAuth.EnableHybridFlow &&
if (options.OAuth.EnableLegacyGrantTypes &&
options.OAuth.LegacyGrantTypeClients.TryGetValue("hybrid", out List<string>? hybridClients) &&
hybridClients.Count > 0)
{
Expand Down
2 changes: 1 addition & 1 deletion SecurityService/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
"PasswordResetTokenExpiryInHours": 2
},
"OAuth": {
"EnableHybridFlow": true,
"EnableLegacyGrantTypes": true,
"LegacyGrantTypeClients": {
"hybrid": [
"managementUIClient"
Expand Down
2 changes: 1 addition & 1 deletion SecurityService/appsettings.staging.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"PublicOrigin": "https://192.168.1.163:5001",
"IssuerUrl": "https://192.168.1.163:5001",
"OAuth": {
"EnableHybridFlow": true,
"EnableLegacyGrantTypes": true,
"LegacyGrantTypeClients": {
"hybrid": [
"managementUIClient"
Expand Down
Loading