OpenIddict

https://documentation.openiddict.com
Admin
OpenIddict is a versatile OAuth 2.0/OpenID Connect stack for .NET, providing client, server, and...
Tokens:50,075
Snippets:512
Trust Score:7.4
Update:2 months ago
Show doc for...
Tokens:
Raw
### Install System Integration Package

Source: https://documentation.openiddict.com/integrations/operating-systems

Add the OpenIddict.Client.SystemIntegration NuGet package to your project.

```xml
<PackageReference Include="OpenIddict.Client.SystemIntegration" Version="7.6.0" />
```

--------------------------------

### Install OpenIddict Web Integration Package

Source: https://documentation.openiddict.com/integrations/web-providers

Add the required NuGet package to your project.

```xml
<PackageReference Include="OpenIddict.Client.WebIntegration" Version="7.6.0" />
```

--------------------------------

### Install OpenIddict Entity Framework package

Source: https://documentation.openiddict.com/integrations/entity-framework

Add the required NuGet package to your project.

```xml
<PackageReference Include="OpenIddict.EntityFramework" Version="7.6.0" />
```

--------------------------------

### Registering a client application

Source: https://documentation.openiddict.com/guides/getting-started/creating-your-own-server-instance

Demonstrates how to programmatically create a client application in the database before the application host starts.

```csharp
// ...

// Before starting the host, create the database used to store the application data.
//
// Note: in a real world application, this step should be part of a setup script.
await using (var scope = app.Services.CreateAsyncScope())
{
    var context = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
    await context.Database.EnsureCreatedAsync();

    var manager = scope.ServiceProvider.GetRequiredService<IOpenIddictApplicationManager>();
    if (await manager.FindByClientIdAsync("service-worker") is null)
    {
        await manager.CreateAsync(new OpenIddictApplicationDescriptor
        {
            ClientId = "service-worker",
            ClientSecret = "388D45FA-B36B-4988-BA59-B187D329C207",
            Permissions =
            {
                Permissions.Endpoints.Token,
                Permissions.GrantTypes.ClientCredentials
            }
        });
    }
}

await app.RunAsync();
```

--------------------------------

### Install OpenIddict Entity Framework Core package

Source: https://documentation.openiddict.com/integrations/entity-framework-core

Add the required NuGet package to your project.

```xml
<PackageReference Include="OpenIddict.EntityFrameworkCore" Version="7.6.0" />
```

--------------------------------

### Install OpenIddict.AspNetCore NuGet package

Source: https://documentation.openiddict.com/guides/getting-started/implementing-token-validation-in-your-apis

Add the required OpenIddict package to your project file.

```xml
<PackageReference Include="OpenIddict.AspNetCore" Version="7.6.0" />
```

--------------------------------

### Example userinfo response log

Source: https://documentation.openiddict.com/guides/contributing-a-new-web-provider

Log output showing a nested userinfo response structure.

```text
OpenIddict.Client.OpenIddictClientDispatcher: Information: The userinfo response returned by https://contoso.com/users/me was successfully extracted: {
  "data": {
    "username": "odile.donat",
    "name": "Odile Donat",
    "email": "odile.donat@fabrikam.com"
  }
}.
```

--------------------------------

### Authorization Request Examples

Source: https://documentation.openiddict.com/guides/choosing-the-right-flow

HTTP examples showing the 302 redirect response and the subsequent GET request to the authorization endpoint.

```http
HTTP/1.1 302 Found
Location: https://server.example.com/authorize?response_type=code&client_id=s6BhdRkqt3&state=af0ifjsldkj&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
```

```http
GET /connect/authorize?response_type=code&client_id=s6BhdRkqt3&state=af0ifjsldkj&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1
Host: server.example.com
```

--------------------------------

### Install OpenIddict NuGet Packages

Source: https://documentation.openiddict.com/integrations/aspnet-core

Add the necessary OpenIddict packages to your project file to enable client, server, or validation features.

```xml
<PackageReference Include="OpenIddict.Client.AspNetCore" Version="7.6.0" />
<PackageReference Include="OpenIddict.Server.AspNetCore" Version="7.6.0" />
<PackageReference Include="OpenIddict.Validation.AspNetCore" Version="7.6.0" />
```

--------------------------------

### Handle authentication errors

Source: https://documentation.openiddict.com/integrations/web-providers

Example of catching authentication exceptions and providing user feedback via a message box.

```csharp
            catch
            {
                MessageBox.Show("An error occurred while trying to authenticate the user.",
                    "Authentication failed", MessageBoxButton.OK, MessageBoxImage.Error);
            }
        }

        finally
        {
            // Re-enable the login button to allow starting a new authentication operation.
            LoginButton.IsEnabled = true;
        }
    }
}
```

--------------------------------

### Create Identity and Sign In with OpenIddict

Source: https://documentation.openiddict.com/introduction

Demonstrates creating a ClaimsIdentity and signing in using the OpenIddictServerAspNetCoreDefaults authentication scheme.

```csharp
// Create a new identity and import a few select claims from the Steam principal.
    var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType);
    identity.AddClaim(new Claim(Claims.Subject, identifier));
    identity.AddClaim(new Claim(Claims.Name, identifier).SetDestinations(Destinations.AccessToken));

    return Results.SignIn(new ClaimsPrincipal(identity), properties: null, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
});
```

--------------------------------

### Configure Product Information

Source: https://documentation.openiddict.com/integrations/system-net-http

Set product name and version or assembly information to customize the User-Agent header.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.UseSystemNetHttp()
               .SetProductInformation("Contoso", "1.0.0");
    })
    .AddValidation(options =>
    {
        options.UseSystemNetHttp()
               .SetProductInformation("Contoso", "1.0.0");
    });
```

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.UseSystemNetHttp()
               .SetProductInformation(typeof(Program).Assembly);
    })
    .AddValidation(options =>
    {
        options.UseSystemNetHttp()
               .SetProductInformation(typeof(Program).Assembly);
    });
```

--------------------------------

### Authorization Code Flow Response

Source: https://documentation.openiddict.com/guides/choosing-the-right-flow

Example of a successful token response in the authorization code flow.

```json
{
  "access_token":"2YotnFZFEjr1zCsicMWpAA",
  "token_type":"bearer",
  "expires_in":3600
}
```

--------------------------------

### Implicit Flow Authorization Request

Source: https://documentation.openiddict.com/guides/choosing-the-right-flow

HTTP GET request for the implicit flow using the response_type=token parameter.

```http
GET /connect/authorize?response_type=token&client_id=s6BhdRkqt3&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb&scope=openid&state=af0ifjsldkj&nonce=n-0S6_WzA2Mj HTTP/1.1
Host: server.example.com
```

--------------------------------

### Configure Client Registration with Signing Credentials

Source: https://documentation.openiddict.com/configuration/assertion-based-client-authentication

Registers a client with OpenIddict, attaching an ECDSA signing key for assertion-based authentication.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        // ...

        options.AddRegistration(new OpenIddictClientRegistration
        {
            Issuer = new Uri("https://localhost:44395/", UriKind.Absolute),
            ProviderName = "Local",
            ProviderDisplayName = "Local OIDC server",

            ClientId = "mvc",
            Scopes = { Scopes.Email, Scopes.Profile, Scopes.OfflineAccess, "demo_api" },

            RedirectUri = new Uri("callback/login/local", UriKind.Relative),
            PostLogoutRedirectUri = new Uri("callback/logout/local", UriKind.Relative),

            SigningCredentials =
            {
                // Note: in a real world application, the private key MUST NOT be hardcoded
                // and SHOULD instead be stored in a safe place (e.g in a key vault).
                new SigningCredentials(GetECDsaSigningKey(
                    key: "[PEM-encoded key exported via ExportECPrivateKeyPem()]"),
                    SecurityAlgorithms.EcdsaSha256, SecurityAlgorithms.Sha256)
            }
        });
    });
```

--------------------------------

### Create Application Descriptor

Source: https://documentation.openiddict.com/configuration/mutual-tls-authentication

Initializes an application descriptor for the host configuration.

```csharp
await manager.CreateAsync(descriptor);
```

--------------------------------

### Client Credentials Token Request

Source: https://documentation.openiddict.com/guides/choosing-the-right-flow

Example of a POST request to the token endpoint using the client_credentials grant type.

```http
POST /connect/token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=s6BhdRkqt3&client_secret=gX1fBat3bV
```

--------------------------------

### Configure OpenIddict server with pass-through

Source: https://documentation.openiddict.com/introduction

Sets up the server stack with authorization endpoints and enables pass-through mode for custom request handling.

```csharp
builder.Services.AddOpenIddict()
    .AddServer(options =>
    {
        // Enable the authorization and token endpoints.
        options.SetAuthorizationEndpointUris("/authorize")
               .SetTokenEndpointUris("/token");

        // Enable the authorization code flow.
        options.AllowAuthorizationCodeFlow();

        // Register the signing and encryption credentials.
        options.AddDevelopmentEncryptionCertificate()
               .AddDevelopmentSigningCertificate();

        // Register the ASP.NET Core host and configure the authorization endpoint
        // to allow the /authorize minimal API handler to handle authorization requests
        // after being validated by the built-in OpenIddict server event handlers.
        //
        // Token requests will be handled by OpenIddict itself by reusing the identity
        // created by the /authorize handler and stored in the authorization codes.
        options.UseAspNetCore()
               .EnableAuthorizationEndpointPassthrough();
    });
```

--------------------------------

### Resource Owner Password Credentials Token Response

Source: https://documentation.openiddict.com/guides/choosing-the-right-flow

Example of a successful JSON response containing an access token.

```http
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
  "access_token":"2YotnFZFEjr1zCsicMWpAA",
  "token_type":"bearer",
  "expires_in":3600
}
```

--------------------------------

### Register a New Web Provider in Sandbox

Source: https://documentation.openiddict.com/guides/contributing-a-new-web-provider

Configure a new provider integration within the sandbox project's startup or program configuration.

```csharp
// Register the Web providers integrations.
//
// Note: to mitigate mix-up attacks, it's recommended to use a unique redirection endpoint
// URI per provider, unless all the registered providers support returning a special "iss"
// parameter containing their URL as part of authorization responses. For more information,
// see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-4.4.
options.UseWebProviders()
       // ... other providers...
       .Add[provider name](options =>
       {
           options.SetClientId("[client identifier]");
           options.SetClientSecret("[client secret]");
           options.SetRedirectUri("callback/login/[provider name]");

           // Note: depending on the provider, configuring other options MAY be required.
       });
```

--------------------------------

### Resource Owner Password Credentials Token Request

Source: https://documentation.openiddict.com/guides/choosing-the-right-flow

Example of a POST request to the token endpoint using the password grant type.

```http
POST /connect/token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=johndoe&password=A3ddj3w
```

--------------------------------

### Configure OpenIddict stacks

Source: https://documentation.openiddict.com/introduction

Initializes the OpenIddict service with core, client, server, and validation stacks.

```csharp
services.AddOpenIddict()
    .AddCore(options =>
    {
        // ...
    })
    .AddClient(options =>
    {
        // ...
    })
    .AddServer(options =>
    {
        // ...
    })
    .AddValidation(options =>
    {
        // ...
    });
```

--------------------------------

### Handle CustomTabsIntent in Android MAUI

Source: https://documentation.openiddict.com/integrations/operating-systems

Example of using MAUI's IPlatformApplication API to resolve the OpenIddictClientSystemIntegrationService mediator within a custom activity.

```csharp
[Activity(NoHistory = true, LaunchMode = LaunchMode.SingleTop, Exported = true)]
[IntentFilter([Intent.ActionView],
    Categories = [Intent.CategoryDefault, Intent.CategoryBrowsable],
    DataScheme = "com.openiddict.sandbox.maui.client")]
public class CallbackActivity : Activity
{
    protected override async void OnCreate(Bundle? savedInstanceState)
    {
        base.OnCreate(savedInstanceState);

        if (Intent is not Intent intent)
        {
            return;
        }

        var provider = IPlatformApplication.Current?.Services ??
            throw new InvalidOperationException("The dependency injection container cannot be resolved.");
        var service = provider.GetRequiredService<OpenIddictClientSystemIntegrationService>();

        try
        {
            await service.HandleCustomTabsIntentAsync(intent);
        }
```

--------------------------------

### Configure Entity Framework Core

Source: https://documentation.openiddict.com/guides/getting-started/integrating-with-a-remote-server-instance

Set up the database context required for stateful OpenIddict client operations.

```csharp
services.AddDbContext<ApplicationDbContext>(options =>
{
    // Configure Entity Framework Core to use Microsoft SQL Server.
    options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));
```

--------------------------------

### Enable System Integration

Source: https://documentation.openiddict.com/integrations/operating-systems

Basic configuration to enable system integration within the OpenIddict client options.

```csharp
        options.UseSystemIntegration();
    });
```

--------------------------------

### Configure custom primary key type

Source: https://documentation.openiddict.com/integrations/entity-framework-core

Use ReplaceDefaultEntities to specify a custom primary key type, such as Guid, instead of the default string.

```csharp
services.AddOpenIddict()
    .AddCore(options =>
    {
        // Configure OpenIddict to use the default entities with a custom key type.
        options.UseEntityFrameworkCore()
               .UseDbContext<ApplicationDbContext>()
               .ReplaceDefaultEntities<Guid>();
    });
```

```csharp
services.AddDbContext<ApplicationDbContext>(options =>
{
    // Configure Entity Framework Core to use Microsoft SQL Server.
    options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));

    // Register the entity sets needed by OpenIddict but use a custom key type.
    options.UseOpenIddict<Guid>();
});
```

--------------------------------

### Configure System Integration

Source: https://documentation.openiddict.com/integrations/operating-systems

Register the system integration in the OpenIddict client options.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        // ...
```

--------------------------------

### Handle MySQL/MariaDB index size limitations

Source: https://documentation.openiddict.com/guides/migration/60-to-70

Replace default string primary keys with long or Guid to avoid index length errors in MySQL/MariaDB.

```csharp
services.AddOpenIddict()
    .AddCore(options =>
    {
        // ...

        options.UseEntityFrameworkCore()
               .UseDbContext<ApplicationDbContext>()
               .ReplaceDefaultEntities<long>();
    });
```

--------------------------------

### Reference NuGet Packages

Source: https://documentation.openiddict.com/integrations/system-net-http

Add the required OpenIddict System.Net.Http packages to your project file.

```xml
<PackageReference Include="OpenIddict.Client.SystemNetHttp" Version="7.6.0" />
<PackageReference Include="OpenIddict.Validation.SystemNetHttp" Version="7.6.0" />
```

--------------------------------

### Reference OpenIddict.Quartz package

Source: https://documentation.openiddict.com/integrations/quartz

Add the OpenIddict.Quartz NuGet package to your project.

```xml
<PackageReference Include="OpenIddict.Quartz" Version="7.6.0" />
```

--------------------------------

### Implement new IOpenIddictApplicationStore APIs

Source: https://documentation.openiddict.com/guides/migration/40-to-50

New methods required for application stores to support 5.0 features.

```csharp
ValueTask<string?> GetApplicationTypeAsync(TApplication application, CancellationToken cancellationToken);
ValueTask<JsonWebKeySet?> GetJsonWebKeySetAsync(TApplication application, CancellationToken cancellationToken);
ValueTask<ImmutableDictionary<string, string>> GetSettingsAsync(TApplication application, CancellationToken cancellationToken);
ValueTask SetApplicationTypeAsync(TApplication application, string? type, CancellationToken cancellationToken);
ValueTask SetJsonWebKeySetAsync(TApplication application, JsonWebKeySet? set, CancellationToken cancellationToken);
ValueTask SetSettingsAsync(TApplication application, ImmutableDictionary<string, string> settings, CancellationToken cancellationToken);
```

--------------------------------

### Configure a multitenant provider

Source: https://documentation.openiddict.com/guides/contributing-a-new-web-provider

Use a Setting node and {settings.Tenant} placeholders for providers that require dynamic tenant-specific URIs.

```xml
<Provider Name="Zendesk" Id="89fdfe22-c796-4227-a44a-d9cd3c467bbb">
  <!--
    Note: Zendesk is a multitenant provider that relies on subdomains to identify instances.
    As such, the following URIs all include a {settings.Tenant} placeholder that will be
    replaced by OpenIddict at runtime by the tenant configured in the Zendesk settings.
  -->

  <Environment Issuer="https://{settings.Tenant}.zendesk.com/">
    <Configuration AuthorizationEndpoint="https://{settings.Tenant}.zendesk.com/oauth/authorizations/new"
                   TokenEndpoint="https://{settings.Tenant}.zendesk.com/oauth/tokens"
                   UserinfoEndpoint="https://{settings.Tenant}.zendesk.com/api/v2/users/me" />
  </Environment>
```

--------------------------------

### Register Quartz.NET services

Source: https://documentation.openiddict.com/integrations/quartz

Configure Quartz.NET to use dependency injection and an in-memory store.

```csharp
services.AddQuartz(options =>
{
    options.UseMicrosoftDependencyInjectionJobFactory();
    options.UseSimpleTypeLoader();
    options.UseInMemoryStore();
})
```

--------------------------------

### Import credentials using local server integration

Source: https://documentation.openiddict.com/configuration/encryption-and-signing-credentials

Imports signing and encryption credentials from the local server configuration.

```csharp
services.AddOpenIddict()
    .AddValidation(options =>
    {
        options.UseLocalServer();
    });
```

--------------------------------

### Register Web Providers in Client Options

Source: https://documentation.openiddict.com/integrations/web-providers

Enable web provider integrations and configure specific providers like GitHub and Twitter.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        // ...

        // Register the Web providers integrations.
        options.UseWebProviders();
    });
```

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        // Note: to mitigate mix-up attacks, it's recommended to use a unique redirection endpoint
        // URI per provider, unless all the registered providers support returning a special "iss"
        // parameter containing their URL as part of authorization responses. For more information,
        // see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-4.4.
        options.UseWebProviders()
               .AddGitHub(options =>
               {
                   options.SetClientId("[client identifier]")
                          .SetClientSecret("[client secret]")
                          .SetRedirectUri("callback/login/github");
               })
               .AddTwitter(options =>
               {
                   options.SetClientId("[client identifier]")
                          .SetClientSecret("[client secret]")
                          .SetRedirectUri("callback/login/twitter");
               });
    });
```

--------------------------------

### Implement Custom Event Handler

Source: https://documentation.openiddict.com/introduction

Shows how to create a custom event handler by implementing IOpenIddictServerHandler to intercept and validate authorization requests.

```csharp
/// <summary>
/// Contains the logic responsible of rejecting authorization requests that don't specify a valid prompt parameter.
/// </summary>
public class ValidatePromptParameter : IOpenIddictServerHandler<ValidateAuthorizationRequestContext>
{
    /// <summary>
    /// Gets the default descriptor definition assigned to this handler.
    /// </summary>
    public static OpenIddictServerHandlerDescriptor Descriptor { get; }
        = OpenIddictServerHandlerDescriptor.CreateBuilder<ValidateAuthorizationRequestContext>()
            .UseSingletonHandler<ValidatePromptParameter>()
            .SetOrder(ValidateNonceParameter.Descriptor.Order + 1_000)
            .SetType(OpenIddictServerHandlerType.BuiltIn)
            .Build();

    /// <inheritdoc/>
    public ValueTask HandleAsync(ValidateAuthorizationRequestContext context)
    {
        if (context is null)
        {
            throw new ArgumentNullException(nameof(context));
        }

        // Reject requests specifying prompt=none with consent/login or select_account.
        if (context.Request.HasPrompt(Prompts.None) && (context.Request.HasPrompt(Prompts.Consent) ||
                                                        context.Request.HasPrompt(Prompts.Login) ||
                                                        context.Request.HasPrompt(Prompts.SelectAccount)))
        {
            context.Logger.LogInformation(SR.GetResourceString(SR.ID6040));

            context.Reject(
                error: Errors.InvalidRequest,
                description: SR.FormatID2052(Parameters.Prompt),
                uri: SR.FormatID8000(SR.ID2052));

            return default;
        }

        return default;
    }
}
```

--------------------------------

### Configure OpenIddict Quartz integration

Source: https://documentation.openiddict.com/integrations/quartz

Enable the Quartz.NET integration within the OpenIddict core configuration.

```csharp
services.AddOpenIddict()
    .AddCore(options =>
    {
        options.UseQuartz();
    });
```

--------------------------------

### Configure Application Grant Type Permissions

Source: https://documentation.openiddict.com/configuration/application-permissions

Demonstrates creating application descriptors with specific grant type permissions assigned.

```csharp
if (await manager.FindByClientIdAsync("postman") is null)
{
    await manager.CreateAsync(new OpenIddictApplicationDescriptor
    {
        ClientId = "postman",
        DisplayName = "Postman",
        RedirectUris = { new Uri("https://www.getpostman.com/oauth2/callback") },
        Permissions =
        {
            OpenIddictConstants.Permissions.Endpoints.Authorization,
            OpenIddictConstants.Permissions.Endpoints.Token,

            OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode
        }
    });
}

if (await manager.FindByClientIdAsync("console") is null)
{
    await manager.CreateAsync(new OpenIddictApplicationDescriptor
    {
        ClientId = "console",
        DisplayName = "Console",
        Permissions =
        {
            OpenIddictConstants.Permissions.Endpoints.Token,

            OpenIddictConstants.Permissions.GrantTypes.Password,
            OpenIddictConstants.Permissions.GrantTypes.RefreshToken
        }
    });
}
```

--------------------------------

### Enable reference access and refresh tokens

Source: https://documentation.openiddict.com/configuration/token-storage

Configures the server to use reference tokens for access and refresh tokens to reduce payload size.

```csharp
services.AddOpenIddict()
    .AddServer(options =>
    {
        options.UseReferenceAccessTokens()
               .UseReferenceRefreshTokens();
    });
```

--------------------------------

### Configure Application Scope Permissions

Source: https://documentation.openiddict.com/configuration/application-permissions

Demonstrates creating an application descriptor with specific standard and custom scope permissions.

```csharp
if (await manager.FindByClientIdAsync("angular") is null)
{
    await manager.CreateAsync(new OpenIddictApplicationDescriptor
    {
        ClientId = "angular",
        DisplayName = "Angular",
        RedirectUris = { new Uri("https://localhost:34422/callback") },
        Permissions =
        {
            OpenIddictConstants.Permissions.Endpoints.Authorization,
            OpenIddictConstants.Permissions.GrantTypes.Implicit,

            OpenIddictConstants.Permissions.Scopes.Address,
            OpenIddictConstants.Permissions.Scopes.Profile,
            OpenIddictConstants.Permissions.Prefixes.Scope + "marketing_api"
        }
    });
}
```

--------------------------------

### Register database context and core services

Source: https://documentation.openiddict.com/guides/getting-started/creating-your-own-server-instance

Configure the Entity Framework Core database context and register OpenIddict core components in your application startup.

```csharp
services.AddDbContext<ApplicationDbContext>(options =>
{
    // Configure Entity Framework Core to use Microsoft SQL Server.
    options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));

    // Register the entity sets needed by OpenIddict.
    // Note: use the generic overload if you need to replace the default OpenIddict entities.
    options.UseOpenIddict();
});

services.AddOpenIddict()

    // Register the OpenIddict core components.
    .AddCore(options =>
    {
        // Configure OpenIddict to use the Entity Framework Core stores and models.
        // Note: call ReplaceDefaultEntities() to replace the default entities.
        options.UseEntityFrameworkCore()
               .UseDbContext<ApplicationDbContext>();
    });
```

--------------------------------

### Enable PKCE for a provider

Source: https://documentation.openiddict.com/guides/contributing-a-new-web-provider

Add a CodeChallengeMethod node to the configuration to support PKCE.

```xml
<Provider Name="Fitbit" Id="10a558b9-8c81-47cc-8941-e54d0432fd51">
  <Environment Issuer="https://www.fitbit.com/">
    <Configuration AuthorizationEndpoint="https://www.fitbit.com/oauth2/authorize"
                   TokenEndpoint="https://api.fitbit.com/oauth2/token"
                   UserinfoEndpoint="https://api.fitbit.com/1/user/-/profile.json">
      <CodeChallengeMethod Value="S256" />
    </Configuration>
  </Environment>
</Provider>
```

--------------------------------

### Implement authorization controller

Source: https://documentation.openiddict.com/guides/getting-started/creating-your-own-server-instance

Create a controller to handle token exchange requests, specifically for the client credentials grant.

```csharp
public class AuthorizationController : Controller
{
    private readonly IOpenIddictApplicationManager _applicationManager;

    public AuthorizationController(IOpenIddictApplicationManager applicationManager)
        => _applicationManager = applicationManager;

    [HttpPost("~/connect/token"), Produces("application/json")]
    public async Task<IActionResult> Exchange()
    {
        var request = HttpContext.GetOpenIddictServerRequest();
        if (request.IsClientCredentialsGrantType())
        {
            // Note: the client credentials are automatically validated by OpenIddict:
            // if client_id or client_secret are invalid, this action won't be invoked.

            var application = await _applicationManager.FindByClientIdAsync(request.ClientId) ??
                throw new InvalidOperationException("The application cannot be found.");

            // Create a new ClaimsIdentity containing the claims that
            // will be used to create an id_token, a token or a code.
            var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);

            // Use the client_id as the subject identifier.
            identity.SetClaim(Claims.Subject, await _applicationManager.GetClientIdAsync(application));
            identity.SetClaim(Claims.Name, await _applicationManager.GetDisplayNameAsync(application));
```

--------------------------------

### Configure HttpClient using registration details

Source: https://documentation.openiddict.com/integrations/system-net-http

Uses registration metadata to conditionally configure HttpClient instances for advanced scenarios.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.UseSystemNetHttp()
               .ConfigureHttpClient((registration, client) =>
               {
                   if (registration.RegistrationId is "447fbedf-dcec-47b0-9355-6e199e8f2576")
                   {
                       client.DefaultRequestHeaders.Add("Custom-Header", "value");
                   }
               });
    });
```

--------------------------------

### Implement new IOpenIddictTokenStore API

Source: https://documentation.openiddict.com/guides/migration/40-to-50

New method added to the token store interface.

```csharp
ValueTask<long> RevokeByAuthorizationIdAsync(string identifier, CancellationToken cancellationToken);
```

--------------------------------

### Handle authorization request in minimal API

Source: https://documentation.openiddict.com/introduction

Demonstrates a minimal API handler that checks for an existing principal and triggers an authentication challenge if missing.

```csharp
app.MapGet("/authorize", async (HttpContext context) =>
{
    // Resolve the claims stored in the principal created after the Steam authentication dance.
    // If the principal cannot be found, trigger a new challenge to redirect the user to Steam.
    var principal = (await context.AuthenticateAsync(SteamAuthenticationDefaults.AuthenticationScheme))?.Principal;
    if (principal is null)
    {
        return Results.Challenge(properties: null, [SteamAuthenticationDefaults.AuthenticationScheme]);
    }

    var identifier = principal.FindFirst(ClaimTypes.NameIdentifier)!.Value;
```

--------------------------------

### Configure OpenIddict Client Services

Source: https://documentation.openiddict.com/guides/getting-started/integrating-with-a-remote-server-instance

Enables authorization code flow and registers external providers like GitHub with specific client credentials.

```csharp
services.AddOpenIddict()

    // Register the OpenIddict client components.
    .AddClient(options =>
    {
        // Note: this sample only uses the authorization code flow,
        // but you can enable the other flows if necessary.
        options.AllowAuthorizationCodeFlow();

        // Register the signing and encryption credentials used to protect
        // sensitive data like the state tokens produced by OpenIddict.
        options.AddDevelopmentEncryptionCertificate()
               .AddDevelopmentSigningCertificate();

        // Register the ASP.NET Core host and configure the ASP.NET Core-specific options.
        options.UseAspNetCore()
               .EnableRedirectionEndpointPassthrough();

        // Register the System.Net.Http integration.
        options.UseSystemNetHttp();

        // Register the Web providers integrations.
        //
        // Note: to mitigate mix-up attacks, it's recommended to use a unique redirection endpoint
        // URI per provider, unless all the registered providers support returning a special "iss"
        // parameter containing their URL as part of authorization responses. For more information,
        // see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-4.4.
        options.UseWebProviders()
               .AddGitHub(options =>
               {
                   options.SetClientId("c4ade52327b01ddacff3")
                          .SetClientSecret("da6bed851b75e317bf6b2cb67013679d9467c122")
                          .SetRedirectUri("callback/login/github");
               });
    });
```

--------------------------------

### Configure OpenIddict to use Entity Framework 6.x stores

Source: https://documentation.openiddict.com/integrations/entity-framework

Register the Entity Framework stores within the OpenIddict core configuration.

```csharp
services.AddOpenIddict()
    .AddCore(options =>
    {
        options.UseEntityFramework()
               .UseDbContext<ApplicationDbContext>();
    });
```

--------------------------------

### Configure Provider Environments

Source: https://documentation.openiddict.com/guides/contributing-a-new-web-provider

Define environment nodes under the provider. Production environments must be listed first when multiple are present.

```xml
<Provider Name="Salesforce" Id="ce5bc4bc-6133-4e87-85ad-626b3c0a4427">
  <Environment Name="Production" />

  <Environment Name="Development" />
</Provider>
```

```xml
<Provider Name="Google" Id="e0e90ce7-adb5-4b05-9f54-594941e5d960">
  <Environment />
</Provider>
```

--------------------------------

### Configure OpenIddict Client Services

Source: https://documentation.openiddict.com/guides/getting-started/integrating-with-a-remote-server-instance

Register OpenIddict client components and configure flows, token storage, and registration details in your dependency injection container.

```csharp
services.AddOpenIddict()

    // Register the OpenIddict client components.
    .AddClient(options =>
    {
        // Allow grant_type=client_credentials to be negotiated.
        options.AllowClientCredentialsFlow();

        // Disable token storage, which is not necessary for non-interactive flows like
        // grant_type=password, grant_type=client_credentials or grant_type=refresh_token.
        options.DisableTokenStorage();

        // Register the System.Net.Http integration.
        options.UseSystemNetHttp();

        // Add a client registration with the client identifier and secrets issued by the server.
        options.AddRegistration(new OpenIddictClientRegistration
        {
            Issuer = new Uri("https://localhost:44385/", UriKind.Absolute),

            ClientId = "service-worker",
            ClientSecret = "388D45FA-B36B-4988-BA59-B187D329C207"
        });
    });
```

--------------------------------

### Import asymmetric keys via OIDC discovery

Source: https://documentation.openiddict.com/configuration/encryption-and-signing-credentials

Automatically imports asymmetric signing keys using OpenID Connect discovery.

```csharp
services.AddOpenIddict()
    .AddValidation(options =>
    {
        options.SetIssuer("https://localhost:44319/");
        options.UseSystemNetHttp();
    });
```

--------------------------------

### Register OpenIddict Services

Source: https://documentation.openiddict.com/integrations/aspnet-core

Configure OpenIddict features by calling UseAspNetCore within the service registration pipeline.

```csharp
services.AddOpenIddict()
    .AddCore(options =>
    {
        // ...
    })
    .AddClient(options =>
    {
        // ...

        options.UseAspNetCore();
    })
    .AddServer(options =>
    {
        // ...

        options.UseAspNetCore();
    })
    .AddValidation(options =>
    {
        // ...

        options.UseAspNetCore();
    });
```

--------------------------------

### Enable ASP.NET Core integration

Source: https://documentation.openiddict.com/guides/migration/20-to-30

Explicitly register the ASP.NET Core host in the server and validation options as the stacks are now decoupled.

```csharp
services.AddOpenIddict()
    .AddServer(options =>
    {
        options.UseAspNetCore();
    })
    .AddValidation(options =>
    {
        options.UseAspNetCore();
    });
```

--------------------------------

### Register System.Net.Http Integration

Source: https://documentation.openiddict.com/integrations/system-net-http

Enable the System.Net.Http integration by calling UseSystemNetHttp() within the OpenIddict client or validation configuration.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.UseSystemNetHttp();
    })
    .AddValidation(options =>
    {
        options.UseSystemNetHttp();
    });
```

--------------------------------

### Registering development certificates

Source: https://documentation.openiddict.com/configuration/encryption-and-signing-credentials

Configures ephemeral development certificates for local testing in both client and server options.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.AddDevelopmentEncryptionCertificate()
               .AddDevelopmentSigningCertificate();
    })
    .AddServer(options =>
    {
        options.AddDevelopmentEncryptionCertificate()
               .AddDevelopmentSigningCertificate();
    });
```

--------------------------------

### Register client with JsonWebKeySet

Source: https://documentation.openiddict.com/configuration/assertion-based-client-authentication

Configures an OpenIddict application descriptor to use a public key for assertion validation.

```csharp
var descriptor = new OpenIddictApplicationDescriptor
{
    ApplicationType = ApplicationTypes.Web,
    ClientId = "mvc",
    ClientType = ClientTypes.Confidential,
    DisplayName = "MVC client application",
    JsonWebKeySet = new JsonWebKeySet
    {
        Keys =
        {
            // Instead of sending a client secret, this application authenticates by
            // generating client assertions that are signed using an ECDSA signing key.
            //
            // Note: while the client needs access to the private key, the server only needs
            // to know the public key to be able to validate the client assertions it receives.
            JsonWebKeyConverter.ConvertFromECDsaSecurityKey(GetECDsaSigningKey(
                key: "[PEM-encoded key exported via ExportSubjectPublicKeyInfoPem()]"))
        }
    },
    RedirectUris =
    {
        new Uri("https://localhost:44381/callback/login/local")
    },
    PostLogoutRedirectUris =
    {
        new Uri("https://localhost:44381/callback/logout/local")
    },
    Permissions =
    {
        Permissions.Endpoints.Authorization,
        Permissions.Endpoints.EndSession,
        Permissions.Endpoints.PushedAuthorization,
        Permissions.Endpoints.Token,
        Permissions.GrantTypes.AuthorizationCode,
        Permissions.GrantTypes.RefreshToken,
        Permissions.ResponseTypes.Code,
        Permissions.Scopes.Email,
        Permissions.Scopes.Profile,
        Permissions.Scopes.Roles
    },
    Requirements =
    {
        Requirements.Features.ProofKeyForCodeExchange,
        Requirements.Features.PushedAuthorizationRequests
    }
};

await manager.CreateAsync(descriptor);
```

--------------------------------

### Register audiences and resources in server options

Source: https://documentation.openiddict.com/guides/migration/60-to-70

Register allowed audiences and resources to prevent OpenIddict from rejecting requests using these parameters.

```csharp
services.AddOpenIddict()
    .AddServer(options =>
    {
        options.RegisterAudiences("financial_api");
        options.RegisterResources("https://fabrikam.com/financial_api");
    });
```

--------------------------------

### Retrieve and validate permanent authorizations

Source: https://documentation.openiddict.com/configuration/authorization-storage

Demonstrates how to fetch existing permanent authorizations and handle consent logic based on the application's configured consent type.

```csharp
// Retrieve the application details from the database.
var application = await _applicationManager.FindByClientIdAsync(request.ClientId) ??
    throw new InvalidOperationException("The application cannot be found.");

// Retrieve the permanent authorizations associated with the user and the application.
var authorizations = await _authorizationManager.FindAsync(
    subject: await _userManager.GetUserIdAsync(user),
    client : await _applicationManager.GetIdAsync(application),
    status : Statuses.Valid,
    type   : AuthorizationTypes.Permanent,
    scopes : request.GetScopes()).ToListAsync();

switch (await _applicationManager.GetConsentTypeAsync(application))
{
    // If the consent is external (e.g when authorizations are granted by a sysadmin),
    // immediately return an error if no authorization can be found in the database.
    case ConsentTypes.External when !authorizations.Any():
        return Forbid(
            authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
            properties: new AuthenticationProperties(new Dictionary<string, string>
            {
                [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.ConsentRequired,
                [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =
                    "The logged in user is not allowed to access this client application."
            }));

    // If the consent is implicit or if an authorization was found,
    // return an authorization response without displaying the consent form.
    case ConsentTypes.Implicit:
    case ConsentTypes.External when authorizations.Any():
    case ConsentTypes.Explicit when authorizations.Any() && !request.HasPrompt(Prompts.Consent):
        // Create the claims-based identity that will be used by OpenIddict to generate tokens.
        var identity = new ClaimsIdentity(
            authenticationType: TokenValidationParameters.DefaultAuthenticationType,
            nameType: Claims.Name,
            roleType: Claims.Role);

        // Add the claims that will be persisted in the tokens.
        identity.SetClaim(Claims.Subject, await _userManager.GetUserIdAsync(user))
                .SetClaim(Claims.Email, await _userManager.GetEmailAsync(user))
                .SetClaim(Claims.Name, await _userManager.GetUserNameAsync(user))
                .SetClaims(Claims.Role, (await _userManager.GetRolesAsync(user)).ToImmutableArray());

        // Note: in this sample, the granted scopes match the requested scope
        // but you may want to allow the user to uncheck specific scopes.
        // For that, simply restrict the list of scopes before calling SetScopes.
        identity.SetScopes(request.GetScopes());
        identity.SetResources(await _scopeManager.ListResourcesAsync(identity.GetScopes()).ToListAsync());

        // Automatically create a permanent authorization to avoid requiring explicit consent
        // for future authorization or token requests containing the same scopes.
        var authorization = authorizations.LastOrDefault();
        authorization ??= await _authorizationManager.CreateAsync(
            identity: identity,
            subject : await _userManager.GetUserIdAsync(user),
            client  : await _applicationManager.GetIdAsync(application),
            type    : AuthorizationTypes.Permanent,
            scopes  : identity.GetScopes());

        identity.SetAuthorizationId(await _authorizationManager.GetIdAsync(authorization));
        identity.SetDestinations(static claim => claim.Type switch
        {
            // If the "profile" scope was granted, allow the "name" claim to be
            // added to the access and identity tokens derived from the principal.
            Claims.Name when claim.Subject.HasScope(Scopes.Profile) =>
            [
                OpenIddictConstants.Destinations.AccessToken,
                OpenIddictConstants.Destinations.IdentityToken
            ],
```

--------------------------------

### Configure HttpClientHandler with registration context

Source: https://documentation.openiddict.com/integrations/system-net-http

Uses an advanced delegate that provides access to the OpenIddictClientRegistration, allowing conditional configuration based on registration details.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.UseSystemNetHttp()
               .ConfigureHttpClientHandler((registration, handler) =>
               {
                   if (registration.RegistrationId is "447fbedf-dcec-47b0-9355-6e199e8f2576")
                   {
                       handler.ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;
                   }
               });
    });
```

--------------------------------

### Reference OpenIddict.MongoDb package

Source: https://documentation.openiddict.com/integrations/mongodb

Add the required NuGet package to your project file.

```xml
<PackageReference Include="OpenIddict.MongoDb" Version="7.6.0" />
```

--------------------------------

### Define a static provider configuration

Source: https://documentation.openiddict.com/guides/contributing-a-new-web-provider

Use this structure when the server does not support metadata endpoints. Include the issuer and specific endpoint URLs.

```xml
<Provider Name="Reddit" Id="01ae8033-935c-43b9-8568-eaf4d08c0613">
  <Environment Issuer="https://www.reddit.com/">
    <Configuration AuthorizationEndpoint="https://www.reddit.com/api/v1/authorize"
                   TokenEndpoint="https://www.reddit.com/api/v1/access_token"
                   UserinfoEndpoint="https://oauth.reddit.com/api/v1/me">
      <GrantType Value="authorization_code" />
      <GrantType Value="refresh_token" />
    </Configuration>
  </Environment>
</Provider>
```

--------------------------------

### Configure OpenIddict Core with Entity Framework Core

Source: https://documentation.openiddict.com/integrations/entity-framework-core

Register the Entity Framework Core stores within the OpenIddict core configuration.

```csharp
services.AddOpenIddict()
    .AddCore(options =>
    {
        options.UseEntityFrameworkCore()
               .UseDbContext<ApplicationDbContext>();
    });
```

--------------------------------

### Configure Web Authentication Broker

Source: https://documentation.openiddict.com/integrations/operating-systems

Enables the system web authentication broker for OpenIddict client integration.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.UseSystemIntegration()
               .UseWebAuthenticationBroker();
    });
```

--------------------------------

### Register Quartz.NET hosted service

Source: https://documentation.openiddict.com/integrations/quartz

Register the hosted service and ensure it waits for jobs to complete during shutdown.

```csharp
services.AddQuartzHostedService(options => options.WaitForJobsToComplete = true);
```

--------------------------------

### Configure Pipe Options and Security

Source: https://documentation.openiddict.com/integrations/operating-systems

Override default named pipe settings, including name, options, and security ACLs.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.UseSystemIntegration()
               .SetPipeName("PIPE_NAME")
               .SetPipeOptions(...)
               .SetPipeSecurity(...);
    });
```

--------------------------------

### Register multiple provider instances

Source: https://documentation.openiddict.com/integrations/web-providers

Configure multiple instances of the same provider by assigning unique provider names to each registration.

```csharp
services.AddOpenIddict()
    .AddClient(options =>
    {
        options.UseWebProviders()
               .AddGitHub(options =>
               {
                   options.SetClientId("[client identifier A]")
                          .SetClientSecret("[client secret A]")
                          .SetRedirectUri("callback/login/github/a")
                          .SetProviderName("GitHub-Instance-A");
               })
               .AddGitHub(options =>
               {
                   options.SetClientId("[client identifier B]")
                          .SetClientSecret("[client secret B]")
                          .SetRedirectUri("callback/login/github/b")
                          .SetProviderName("GitHub-Instance-B");
               });
    });
```

```csharp
[HttpPost("~/login"), ValidateAntiForgeryToken]
public async Task<ActionResult> LogInWithGitHubInstanceA(string returnUrl)
{
    var properties = new AuthenticationProperties
    {
        // Only allow local return URLs to prevent open redirect attacks.
        RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "/"
    };

    // Ask the OpenIddict client middleware to redirect the
    // user agent to GitHub using the "Instance A" settings.
    return Challenge(properties, "GitHub-Instance-A");
}
```

--------------------------------

### Configure OpenIddict server services

Source: https://documentation.openiddict.com/guides/getting-started/creating-your-own-server-instance

Define token endpoints, authentication flows, and security credentials for the OpenIddict server.

```csharp
services.AddOpenIddict()

    // Register the OpenIddict server components.
    .AddServer(options =>
    {
        // Enable the token endpoint.
        options.SetTokenEndpointUris("connect/token");

        // Enable the client credentials flow.
        options.AllowClientCredentialsFlow();

        // Register the signing and encryption credentials.
        options.AddDevelopmentEncryptionCertificate()
               .AddDevelopmentSigningCertificate();

        // Register the ASP.NET Core host and configure the ASP.NET Core options.
        options.UseAspNetCore()
               .EnableTokenEndpointPassthrough();
    });
```

--------------------------------

### Reference OpenIddict Package

Source: https://documentation.openiddict.com/guides/getting-started/integrating-with-a-remote-server-instance

Add the OpenIddict NuGet package to your .csproj file for non-interactive client implementations.

```xml
<PackageReference Include="OpenIddict" Version="7.6.0" />
```

--------------------------------

### Trigger Authentication Challenge in Desktop Applications

Source: https://documentation.openiddict.com/integrations/web-providers

Use OpenIddictClientService to perform interactive authentication in WPF or other desktop environments.

```csharp
public partial class MainWindow : Window, IWpfShell
{
    private readonly OpenIddictClientService _service;

    public MainWindow(OpenIddictClientService service)
    {
        _service = service ?? throw new ArgumentNullException(nameof(service));

        InitializeComponent();
    }

    private async void LoginButton_Click(object sender, RoutedEventArgs e)
    {
        // Disable the login button to prevent concurrent authentication operations.
        LoginButton.IsEnabled = false;

        try
        {
            using var source = new CancellationTokenSource(delay: TimeSpan.FromSeconds(90));

            try
            {
                // Ask OpenIddict to initiate the authentication flow (typically, by starting the system browser).
                var result = await _service.ChallengeInteractivelyAsync(new()
                {
                    CancellationToken = source.Token,
                    ProviderName = OpenIddictClientWebIntegrationConstants.Providers.GitHub
                });

                // Wait for the user to complete the authorization process.
                var principal = (await _service.AuthenticateInteractivelyAsync(new()
                {
                    CancellationToken = source.Token,
                    Nonce = result.Nonce
                })).Principal;

                MessageBox.Show($"Welcome, {principal.FindFirst(ClaimTypes.Name)!.Value}.",
                    "Authentication successful", MessageBoxButton.OK, MessageBoxImage.Information);
            }

            catch (OperationCanceledException)
            {
                MessageBox.Show("The authentication process was aborted.",
                    "Authentication timed out", MessageBoxButton.OK, MessageBoxImage.Warning);
            }

            catch (ProtocolException exception) when (exception.Error is Errors.AccessDenied)
            {
                MessageBox.Show("The authorization was denied by the end user.",
                    "Authorization denied", MessageBoxButton.OK, MessageBoxImage.Warning);
            }
```

--------------------------------

### Implement OAuth 2.0 Callback Controller

Source: https://documentation.openiddict.com/guides/getting-started/integrating-with-a-remote-server-instance

Handles incoming OAuth 2.0/OpenID Connect callbacks and maps external claims to a local authentication cookie.

```csharp
[HttpGet("~/callback/login/{provider}"), HttpPost("~/callback/login/{provider}"), IgnoreAntiforgeryToken]
public async Task<ActionResult> LogInCallback()
{
    // Retrieve the authorization data validated by OpenIddict as part of the callback handling.
    var result = await HttpContext.AuthenticateAsync(OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);

    // Important: if the remote server doesn't support OpenID Connect and doesn't expose a userinfo endpoint,
    // result.Principal.Identity will represent an unauthenticated identity and won't contain any user claim.
    //
    // Such identities cannot be used as-is to build an authentication cookie in ASP.NET Core (as the
    // antiforgery stack requires at least a name claim to bind CSRF cookies to the user's identity) but
    // the access/refresh tokens can be retrieved using result.Properties.GetTokens() to make API calls.
    if (result.Principal is not ClaimsPrincipal { Identity.IsAuthenticated: true })
    {
        throw new InvalidOperationException("The external authorization data cannot be used for authentication.");
    }

    // Build an identity based on the external claims and that will be used to create the authentication cookie.
    var identity = new ClaimsIdentity(authenticationType: "ExternalLogin");

    // By default, OpenIddict will automatically try to map the email/name and name identifier claims from
    // their standard OpenID Connect or provider-specific equivalent, if available. If needed, additional
    // claims can be resolved from the external identity and copied to the final authentication cookie.
    identity.SetClaim(ClaimTypes.Email, result.Principal.GetClaim(ClaimTypes.Email))
            .SetClaim(ClaimTypes.Name, result.Principal.GetClaim(ClaimTypes.Name))
            .SetClaim(ClaimTypes.NameIdentifier, result.Principal.GetClaim(ClaimTypes.NameIdentifier));

    // Preserve the registration identifier to be able to resolve it later.
    identity.SetClaim(Claims.Private.RegistrationId, result.Principal.GetClaim(Claims.Private.RegistrationId));
```
Tokens:
Raw