openiddict-documentation/configuration/application-permissions.md

Application permissions

OpenIddict includes a built-in feature codenamed "application permissions" that allows controlling and limiting the OAuth 2.0/OpenID Connect features each registered client application is able to use.

4 categories of permissions are currently supported:

• Endpoint permissions.
• Grant type permissions.
• Scope permissions.
• Response type permissions (introduced in OpenIddict 3.0).

Endpoint permissions

Definition

Endpoint permissions limit the endpoints a client application can use.

Supported permissions

Endpoint	Constant
Authorization	OpenIddictConstants.Permissions.Endpoints.Authorization
Introspection	OpenIddictConstants.Permissions.Endpoints.Introspection
Logout/end session	OpenIddictConstants.Permissions.Endpoints.Logout
Revocation	OpenIddictConstants.Permissions.Endpoints.Revocation
Token	OpenIddictConstants.Permissions.Endpoints.Token

Example

In the following example, the mvc application is allowed to use the authorization, logout and token endpoints but will get an error when trying to send an introspection or revocation request:

if (await manager.FindByClientIdAsync("mvc") is null)
{
    await manager.CreateAsync(new OpenIddictApplicationDescriptor
    {
        ClientId = "mvc",
        ClientSecret = "901564A5-E7FE-42CB-B10D-61EF6A8F3654",
        DisplayName = "MVC client application",
        PostLogoutRedirectUris = { new Uri("http://localhost:53507/signout-callback-oidc") },
        RedirectUris = { new Uri("http://localhost:53507/signin-oidc") },
        Permissions =
        {
            OpenIddictConstants.Permissions.Endpoints.Authorization,
            OpenIddictConstants.Permissions.Endpoints.Logout,
            OpenIddictConstants.Permissions.Endpoints.Token
        }
    });
}

Disabling endpoint permissions

If you don't want to use endpoint permissions, call options.IgnoreEndpointPermissions() to ignore them:

services.AddOpenIddict()
    .AddServer(options =>
    {
        options.IgnoreEndpointPermissions();
    });

Grant type permissions

Definition

Grant type permissions limit the grant types a client application is allowed to use.

Supported permissions

Grant type	Constant
Authorization code	OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode
Client credentials	OpenIddictConstants.Permissions.GrantTypes.ClientCredentials
Implicit	OpenIddictConstants.Permissions.GrantTypes.Implicit
Password	OpenIddictConstants.Permissions.GrantTypes.Password
Refresh token	OpenIddictConstants.Permissions.GrantTypes.RefreshToken

To add a custom grant type permission, you can use the following pattern:

OpenIddictConstants.Permissions.Prefixes.GrantType + "custom_flow_name"

Example

In the following example, the postman application can only use the authorization code grant while console is restricted to the password and refresh_token grants:

if (await manager.FindByClientIdAsync("postman") is null)
{
    await manager.CreateAsync(new OpenIddictApplicationDescriptor
    {
        ClientId = "postman",
        DisplayName = "Postman",
        RedirectUris = { new Uri("https://www.getpostman.com/oauth2/callback") },
        Permissions =
        {
            OpenIddictConstants.Permissions.Endpoints.Authorization,
            OpenIddictConstants.Permissions.Endpoints.Token,

            OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode
        }
    });
}

if (await manager.FindByClientIdAsync("console") is null)
{
    await manager.CreateAsync(new OpenIddictApplicationDescriptor
    {
        ClientId = "console",
        DisplayName = "Console",
        Permissions =
        {
            OpenIddictConstants.Permissions.Endpoints.Token,

            OpenIddictConstants.Permissions.GrantTypes.Password,
            OpenIddictConstants.Permissions.GrantTypes.RefreshToken
        }
    });
}

Disabling grant type permissions

If you don't want to use grant type permissions, call options.IgnoreGrantTypePermissions() to ignore them:

services.AddOpenIddict()
    .AddServer(options =>
    {
        options.IgnoreGrantTypePermissions();
    });

Scope permissions

Definition

Scope permissions limit the scopes (standard or custom) a client application is allowed to use.

Note

The openid and offline_access scopes are special-cased by OpenIddict and don't require explicit permissions.

Supported permissions

Scope	Constant
address	OpenIddictConstants.Permissions.Scopes.Address
email	OpenIddictConstants.Permissions.Scopes.Email
phone	OpenIddictConstants.Permissions.Scopes.Phone
profile	OpenIddictConstants.Permissions.Scopes.Profile
roles	OpenIddictConstants.Permissions.Scopes.Roles

To add a custom scope permission, you can use the following pattern:

OpenIddictConstants.Permissions.Prefixes.Scope + "custom_scope_name"

Example

In the following sample, the angular client is allowed to request the address, profile and marketing_api scopes: any other scope will result in an error being returned.

if (await manager.FindByClientIdAsync("angular") is null)
{
    await manager.CreateAsync(new OpenIddictApplicationDescriptor
    {
        ClientId = "angular",
        DisplayName = "Angular",
        RedirectUris = { new Uri("https://localhost:34422/callback") },
        Permissions =
        {
            OpenIddictConstants.Permissions.Endpoints.Authorization,
            OpenIddictConstants.Permissions.GrantTypes.Implicit,

            OpenIddictConstants.Permissions.Scopes.Address,
            OpenIddictConstants.Permissions.Scopes.Profile,
            OpenIddictConstants.Permissions.Prefixes.Scope + "marketing_api"
        }
    });
}

Disabling scope permissions

If you don't want to use scope permissions, call options.IgnoreScopePermissions() to ignore them:

services.AddOpenIddict()
    .AddServer(options =>
    {
        options.IgnoreScopePermissions();
    });

Response type permissions

Note

Response type permissions were introduced in OpenIddict 3.0.

Definition

Response type permissions limit the response types a client application is allowed to use when implementing an interactive flow like code, implicit or hybrid.

Supported permissions

Response type	Constant
code	OpenIddictConstants.Permissions.ResponseTypes.Code
code id_token	OpenIddictConstants.Permissions.ResponseTypes.CodeIdToken
code id_token token	OpenIddictConstants.Permissions.ResponseTypes.CodeIdTokenToken
code token	OpenIddictConstants.Permissions.ResponseTypes.CodeToken
id_token	OpenIddictConstants.Permissions.ResponseTypes.IdToken
id_token token	OpenIddictConstants.Permissions.ResponseTypes.IdTokenToken
none	OpenIddictConstants.Permissions.ResponseTypes.None
token	OpenIddictConstants.Permissions.ResponseTypes.Token

Example

In the following example, the postman application can only use the code id_token response type:

if (await manager.FindByClientIdAsync("postman") is null)
{
    await manager.CreateAsync(new OpenIddictApplicationDescriptor
    {
        ClientId = "postman",
        DisplayName = "Postman",
        RedirectUris = { new Uri("https://www.getpostman.com/oauth2/callback") },
        Permissions =
        {
            OpenIddictConstants.Permissions.Endpoints.Authorization,
            OpenIddictConstants.Permissions.Endpoints.Token,

            OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode,

            OpenIddictConstants.Permissions.ResponseTypes.CodeIdToken
        }
    });
}

Disabling response type permissions

If you don't want to use response type permissions, call options.IgnoreResponseTypePermissions() to ignore them:

services.AddOpenIddict()
    .AddServer(options =>
    {
        options.IgnoreResponseTypePermissions();
    });