OWIN middleware for OpenID Connect - Code flow ( Flow type - AuthorizationCode) documentation?
Edit: good news, code flow and response_mode=query
support was finally added to Katana, as part of the 4.1 release (that shipped in November 2019): https://github.com/aspnet/AspNetKatana/wiki/Roadmap#410-release-november-2019.
The OpenID Connect middleware doesn't support the code flow: http://katanaproject.codeplex.com/workitem/247 (it's already fixed in the ASP.NET 5 version, though).
Actually, only the implicit flow (id_token
) is officially supported, and you have to use the response_mode=form_post
extension. Trying to use the authorization code flow will simply result in an exception being thrown during the callback, because it won't be able to extract the (missing) id_token
from the authentication response.
Though not directly supported, you can also use the hybrid flow (code
+ id_token (+ token)
), but it's up to you to implement the token request part. You can see https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/blob/dev/samples/Nancy/Nancy.Client/Startup.cs#L82-L115 for an example.