How to get id_token along with access_token from identityserver4 via “password” grant_type?

17
votes

I am trying to build an identity provider application using identityserver4; Currently, I am using "Resource Owner Password Credentials" flow and it returns access_token and refresh_token from token endpoint.

Code Snippet for calling TokenEndpoint from Client

var tokenClient = new TokenClient(<TokenEndpoint>, <ClientId>, <ClientSecret>);           
var tokenResponse = await tokenClient.RequestResourceOwnerPasswordAsync(<UserName>, <password>, <Scopes>);

My Question is, How to get "id_token" along with "access_token" and "refresh_token" by using the same "Resource Owner Password Credentials" flow?

1
asp.net-coreopenid-connectidentityserver4

1 Answers

22
votes

How to get "id_token" along with "access_token" and "refresh_token" by using the same "Resource Owner Password Credentials" flow?

You don't.

In IdentityServer4, the Resource Owner Password Credentials flow provides only access tokens. If you also want an id token, then use the Authorization Code flow, the Implicit Code flow, or the Hybrid flow.

                                       access_token   id_token   refresh_token

Resource Owner Password Credentials        yes           -           yes

Authorization Code                         yes          yes          yes 

Implicit Flow                              yes          yes           -

Since you're wanting all three token types, and since you appear to be using server-side code, the Authorization Code flow fits best. Some kinds of Hybrid Flow will also work for you.

From the docs:

The OAuth 2.0 resource owner password grant allows a client to send username and password to the token service and get an access token back that represents that user.

From a GitHub issue:

OpenID Connect does not specify the resource owner flow - only interactive logons at the authorization server (like code or implicit flow). So [in other words,] no identity token - only access tokens.