Merge pull request #16702 from abpframework/gterdem/openiddict_dataseeder_enhancement

OpenIddict data seeding enhancements

templates/app/aspnet-core/src/MyCompanyName.MyProjectName.DbMigrator/MyCompanyName.MyProjectName.DbMigrator.csproj

@@ -18,6 +18,9 @@
   </ItemGroup>
 
   <ItemGroup>
+    <!-- <TEMPLATE-REMOVE IF-NOT='TIERED'>  -->
+    <ProjectReference Include="..\..\..\..\..\framework\src\Volo.Abp.Caching.StackExchangeRedis\Volo.Abp.Caching.StackExchangeRedis.csproj" />
+    <!-- </TEMPLATE-REMOVE> -->
     <PackageReference Include="Serilog.Extensions.Logging" Version="3.1.0" />
     <PackageReference Include="Serilog.Sinks.Async" Version="1.5.0" />
     <PackageReference Include="Serilog.Sinks.File" Version="5.0.0" />

templates/app/aspnet-core/src/MyCompanyName.MyProjectName.DbMigrator/MyProjectNameDbMigratorModule.cs

@@ -1,15 +1,27 @@
 using MyCompanyName.MyProjectName.EntityFrameworkCore;
 using Volo.Abp.Autofac;
+using Volo.Abp.Caching;
+//<TEMPLATE-REMOVE IF-NOT='TIERED'>
+using Volo.Abp.Caching.StackExchangeRedis;
+//</TEMPLATE-REMOVE>
 using Volo.Abp.Modularity;
 
 namespace MyCompanyName.MyProjectName.DbMigrator;
 
 [DependsOn(
     typeof(AbpAutofacModule),
+    //<TEMPLATE-REMOVE IF-NOT='TIERED'>
+    typeof(AbpCachingStackExchangeRedisModule),
+    //</TEMPLATE-REMOVE>
     typeof(MyProjectNameEntityFrameworkCoreModule),
     typeof(MyProjectNameApplicationContractsModule)
     )]
 public class MyProjectNameDbMigratorModule : AbpModule
 {
-
+    //<TEMPLATE-REMOVE IF-NOT='TIERED'>
+    public override void ConfigureServices(ServiceConfigurationContext context)
+    {
+        Configure<AbpDistributedCacheOptions>(options => { options.KeyPrefix = "MyProjectName:"; });
+    }
+    //</TEMPLATE-REMOVE>
 }

templates/app/aspnet-core/src/MyCompanyName.MyProjectName.DbMigrator/appsettings.json

@@ -2,6 +2,11 @@
   "ConnectionStrings": {
     "Default": "Server=(LocalDb)\\MSSQLLocalDB;Database=MyProjectName;Trusted_Connection=True;TrustServerCertificate=True"
   },
+  //<TEMPLATE-REMOVE IF-NOT='TIERED'>
+  "Redis": {
+    "Configuration": "127.0.0.1"
+  },
+  //</TEMPLATE-REMOVE>
   "OpenIddict": {
     "Applications": {
       "MyProjectName_Web": {

templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Domain/OpenIddict/OpenIddictDataSeedContributor.cs

@@ -1,16 +1,19 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Text.Json;
 using System.Threading.Tasks;
 using JetBrains.Annotations;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Localization;
+using Microsoft.Extensions.Logging;
 using OpenIddict.Abstractions;
 using Volo.Abp;
 using Volo.Abp.Authorization.Permissions;
 using Volo.Abp.Data;
 using Volo.Abp.DependencyInjection;
 using Volo.Abp.OpenIddict.Applications;
+using Volo.Abp.OpenIddict.Scopes;
 using Volo.Abp.PermissionManagement;
 using Volo.Abp.Uow;
 
@@ -22,20 +25,26 @@ namespace MyCompanyName.MyProjectName.OpenIddict;
 public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDependency
 {
     private readonly IConfiguration _configuration;
+    private readonly IOpenIddictApplicationRepository _openIddictApplicationRepository;
     private readonly IAbpApplicationManager _applicationManager;
+    private readonly IOpenIddictScopeRepository _openIddictScopeRepository;
     private readonly IOpenIddictScopeManager _scopeManager;
     private readonly IPermissionDataSeeder _permissionDataSeeder;
     private readonly IStringLocalizer<OpenIddictResponse> L;
 
     public OpenIddictDataSeedContributor(
         IConfiguration configuration,
+        IOpenIddictApplicationRepository openIddictApplicationRepository,
         IAbpApplicationManager applicationManager,
+        IOpenIddictScopeRepository openIddictScopeRepository,
         IOpenIddictScopeManager scopeManager,
         IPermissionDataSeeder permissionDataSeeder,
-        IStringLocalizer<OpenIddictResponse> l)
+        IStringLocalizer<OpenIddictResponse> l )
     {
         _configuration = configuration;
+        _openIddictApplicationRepository = openIddictApplicationRepository;
         _applicationManager = applicationManager;
+        _openIddictScopeRepository = openIddictScopeRepository;
         _scopeManager = scopeManager;
         _permissionDataSeeder = permissionDataSeeder;
         L = l;
@@ -50,24 +59,17 @@ public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDep
 
     private async Task CreateScopesAsync()
     {
-        if (await _scopeManager.FindByNameAsync("MyProjectName") == null)
+        if (await _openIddictScopeRepository.FindByNameAsync("MyProjectName") == null)
         {
-            await _scopeManager.CreateAsync(new OpenIddictScopeDescriptor
+            await _scopeManager.CreateAsync(new OpenIddictScopeDescriptor {
-            {
+                Name = "MyProjectName", DisplayName = "MyProjectName API", Resources = { "MyProjectName" }
-                Name = "MyProjectName",
-                DisplayName = "MyProjectName API",
-                Resources =
-                {
-                    "MyProjectName"
-                }
             });
         }
     }
 
     private async Task CreateApplicationsAsync()
     {
-        var commonScopes = new List<string>
+        var commonScopes = new List<string> {
-        {
             OpenIddictConstants.Permissions.Scopes.Address,
             OpenIddictConstants.Permissions.Scopes.Email,
             OpenIddictConstants.Permissions.Scopes.Phone,
@@ -94,8 +96,7 @@ public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDep
                 secret: configurationSection["MyProjectName_Web:ClientSecret"] ?? "1q2w3e*",
                 grantTypes: new List<string> //Hybrid flow
                 {
-                    OpenIddictConstants.GrantTypes.AuthorizationCode,
+                    OpenIddictConstants.GrantTypes.AuthorizationCode, OpenIddictConstants.GrantTypes.Implicit
-                    OpenIddictConstants.GrantTypes.Implicit
                 },
                 scopes: commonScopes,
                 redirectUri: $"{webClientRootUrl}signin-oidc",
@@ -115,8 +116,7 @@ public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDep
                 consentType: OpenIddictConstants.ConsentTypes.Implicit,
                 displayName: "Console Test / Angular Application",
                 secret: null,
-                grantTypes: new List<string>
+                grantTypes: new List<string> {
-                {
                     OpenIddictConstants.GrantTypes.AuthorizationCode,
                     OpenIddictConstants.GrantTypes.Password,
                     OpenIddictConstants.GrantTypes.ClientCredentials,
@@ -141,10 +141,7 @@ public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDep
                 consentType: OpenIddictConstants.ConsentTypes.Implicit,
                 displayName: "Blazor Application",
                 secret: null,
-                grantTypes: new List<string>
+                grantTypes: new List<string> { OpenIddictConstants.GrantTypes.AuthorizationCode, },
-                {
-                    OpenIddictConstants.GrantTypes.AuthorizationCode,
-                },
                 scopes: commonScopes,
                 redirectUri: $"{blazorRootUrl}/authentication/login-callback",
                 clientUri: blazorRootUrl,
@@ -156,7 +153,8 @@ public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDep
         var blazorServerTieredClientId = configurationSection["MyProjectName_BlazorServerTiered:ClientId"];
         if (!blazorServerTieredClientId.IsNullOrWhiteSpace())
         {
-            var blazorServerTieredRootUrl = configurationSection["MyProjectName_BlazorServerTiered:RootUrl"].EnsureEndsWith('/');
+            var blazorServerTieredRootUrl =
+                configurationSection["MyProjectName_BlazorServerTiered:RootUrl"].EnsureEndsWith('/');
 
             await CreateApplicationAsync(
                 name: blazorServerTieredClientId!,
@@ -166,8 +164,7 @@ public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDep
                 secret: configurationSection["MyProjectName_BlazorServerTiered:ClientSecret"] ?? "1q2w3e*",
                 grantTypes: new List<string> //Hybrid flow
                 {
-                    OpenIddictConstants.GrantTypes.AuthorizationCode,
+                    OpenIddictConstants.GrantTypes.AuthorizationCode, OpenIddictConstants.GrantTypes.Implicit
-                    OpenIddictConstants.GrantTypes.Implicit
                 },
                 scopes: commonScopes,
                 redirectUri: $"{blazorServerTieredRootUrl}signin-oidc",
@@ -188,10 +185,7 @@ public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDep
                 consentType: OpenIddictConstants.ConsentTypes.Implicit,
                 displayName: "Swagger Application",
                 secret: null,
-                grantTypes: new List<string>
+                grantTypes: new List<string> { OpenIddictConstants.GrantTypes.AuthorizationCode, },
-                {
-                    OpenIddictConstants.GrantTypes.AuthorizationCode,
-                },
                 scopes: commonScopes,
                 redirectUri: $"{swaggerRootUrl}/swagger/oauth2-redirect.html",
                 clientUri: swaggerRootUrl
@@ -212,194 +206,211 @@ public class OpenIddictDataSeedContributor : IDataSeedContributor, ITransientDep
         string? postLogoutRedirectUri = null,
         List<string>? permissions = null)
     {
-        if (!string.IsNullOrEmpty(secret) && string.Equals(type, OpenIddictConstants.ClientTypes.Public, StringComparison.OrdinalIgnoreCase))
+        if (!string.IsNullOrEmpty(secret) && string.Equals(type, OpenIddictConstants.ClientTypes.Public,
+                StringComparison.OrdinalIgnoreCase))
         {
             throw new BusinessException(L["NoClientSecretCanBeSetForPublicApplications"]);
         }
 
-        if (string.IsNullOrEmpty(secret) && string.Equals(type, OpenIddictConstants.ClientTypes.Confidential, StringComparison.OrdinalIgnoreCase))
+        if (string.IsNullOrEmpty(secret) && string.Equals(type, OpenIddictConstants.ClientTypes.Confidential,
+                StringComparison.OrdinalIgnoreCase))
         {
             throw new BusinessException(L["TheClientSecretIsRequiredForConfidentialApplications"]);
         }
 
-        if (!string.IsNullOrEmpty(name) && await _applicationManager.FindByClientIdAsync(name) != null)
+        var client = await _openIddictApplicationRepository.FindByClientIdAsync(name);
+        
+        var application = new AbpApplicationDescriptor {
+            ClientId = name,
+            Type = type,
+            ClientSecret = secret,
+            ConsentType = consentType,
+            DisplayName = displayName,
+            ClientUri = clientUri,
+        };
+
+        Check.NotNullOrEmpty(grantTypes, nameof(grantTypes));
+        Check.NotNullOrEmpty(scopes, nameof(scopes));
+
+        if (new[] { OpenIddictConstants.GrantTypes.AuthorizationCode, OpenIddictConstants.GrantTypes.Implicit }.All(
+                grantTypes.Contains))
         {
-            return;
+            application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.CodeIdToken);
-            //throw new BusinessException(L["TheClientIdentifierIsAlreadyTakenByAnotherApplication"]);
+
+            if (string.Equals(type, OpenIddictConstants.ClientTypes.Public, StringComparison.OrdinalIgnoreCase))
+            {
+                application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.CodeIdTokenToken);
+                application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.CodeToken);
+            }
         }
 
-        var client = await _applicationManager.FindByClientIdAsync(name);
+        if (!redirectUri.IsNullOrWhiteSpace() || !postLogoutRedirectUri.IsNullOrWhiteSpace())
-        if (client == null)
         {
-            var application = new AbpApplicationDescriptor
+            application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Logout);
+        }
+
+        var buildInGrantTypes = new[] {
+            OpenIddictConstants.GrantTypes.Implicit, OpenIddictConstants.GrantTypes.Password,
+            OpenIddictConstants.GrantTypes.AuthorizationCode, OpenIddictConstants.GrantTypes.ClientCredentials,
+            OpenIddictConstants.GrantTypes.DeviceCode, OpenIddictConstants.GrantTypes.RefreshToken
+        };
+
+        foreach (var grantType in grantTypes)
+        {
+            if (grantType == OpenIddictConstants.GrantTypes.AuthorizationCode)
             {
-                ClientId = name,
+                application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode);
-                Type = type,
+                application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.Code);
-                ClientSecret = secret,
+            }
-                ConsentType = consentType,
+
-                DisplayName = displayName,
+            if (grantType == OpenIddictConstants.GrantTypes.AuthorizationCode ||
-                ClientUri = clientUri,
+                grantType == OpenIddictConstants.GrantTypes.Implicit)
-            };
-
-            Check.NotNullOrEmpty(grantTypes, nameof(grantTypes));
-            Check.NotNullOrEmpty(scopes, nameof(scopes));
-
-            if (new [] { OpenIddictConstants.GrantTypes.AuthorizationCode, OpenIddictConstants.GrantTypes.Implicit }.All(grantTypes.Contains))
             {
-                application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.CodeIdToken);
+                application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Authorization);
+            }
+
+            if (grantType == OpenIddictConstants.GrantTypes.AuthorizationCode ||
+                grantType == OpenIddictConstants.GrantTypes.ClientCredentials ||
+                grantType == OpenIddictConstants.GrantTypes.Password ||
+                grantType == OpenIddictConstants.GrantTypes.RefreshToken ||
+                grantType == OpenIddictConstants.GrantTypes.DeviceCode)
+            {
+                application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Token);
+                application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Revocation);
+                application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Introspection);
+            }
 
+            if (grantType == OpenIddictConstants.GrantTypes.ClientCredentials)
+            {
+                application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.ClientCredentials);
+            }
+
+            if (grantType == OpenIddictConstants.GrantTypes.Implicit)
+            {
+                application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.Implicit);
+            }
+
+            if (grantType == OpenIddictConstants.GrantTypes.Password)
+            {
+                application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.Password);
+            }
+
+            if (grantType == OpenIddictConstants.GrantTypes.RefreshToken)
+            {
+                application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.RefreshToken);
+            }
+
+            if (grantType == OpenIddictConstants.GrantTypes.DeviceCode)
+            {
+                application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.DeviceCode);
+                application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Device);
+            }
+
+            if (grantType == OpenIddictConstants.GrantTypes.Implicit)
+            {
+                application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.IdToken);
                 if (string.Equals(type, OpenIddictConstants.ClientTypes.Public, StringComparison.OrdinalIgnoreCase))
                 {
-                    application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.CodeIdTokenToken);
+                    application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.IdTokenToken);
-                    application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.CodeToken);
+                    application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.Token);
                 }
             }
 
-            if (!redirectUri.IsNullOrWhiteSpace() || !postLogoutRedirectUri.IsNullOrWhiteSpace())
+            if (!buildInGrantTypes.Contains(grantType))
             {
-                application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Logout);
+                application.Permissions.Add(OpenIddictConstants.Permissions.Prefixes.GrantType + grantType);
             }
+        }
+
+        var buildInScopes = new[] {
+            OpenIddictConstants.Permissions.Scopes.Address, OpenIddictConstants.Permissions.Scopes.Email,
+            OpenIddictConstants.Permissions.Scopes.Phone, OpenIddictConstants.Permissions.Scopes.Profile,
+            OpenIddictConstants.Permissions.Scopes.Roles
+        };
 
-            var buildInGrantTypes = new []
+        foreach (var scope in scopes)
+        {
+            if (buildInScopes.Contains(scope))
             {
-                OpenIddictConstants.GrantTypes.Implicit,
+                application.Permissions.Add(scope);
-                OpenIddictConstants.GrantTypes.Password,
+            }
-                OpenIddictConstants.GrantTypes.AuthorizationCode,
+            else
-                OpenIddictConstants.GrantTypes.ClientCredentials,
-                OpenIddictConstants.GrantTypes.DeviceCode,
-                OpenIddictConstants.GrantTypes.RefreshToken
-            };
-
-            foreach (var grantType in grantTypes)
             {
-              if (grantType == OpenIddictConstants.GrantTypes.AuthorizationCode)
+                application.Permissions.Add(OpenIddictConstants.Permissions.Prefixes.Scope + scope);
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode);
-                  application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.Code);
-              }
-
-              if (grantType == OpenIddictConstants.GrantTypes.AuthorizationCode || grantType == OpenIddictConstants.GrantTypes.Implicit)
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Authorization);
-              }
-
-              if (grantType == OpenIddictConstants.GrantTypes.AuthorizationCode ||
-                  grantType == OpenIddictConstants.GrantTypes.ClientCredentials ||
-                  grantType == OpenIddictConstants.GrantTypes.Password ||
-                  grantType == OpenIddictConstants.GrantTypes.RefreshToken ||
-                  grantType == OpenIddictConstants.GrantTypes.DeviceCode)
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Token);
-                  application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Revocation);
-                  application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Introspection);
-              }
-
-              if (grantType == OpenIddictConstants.GrantTypes.ClientCredentials)
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.ClientCredentials);
-              }
-
-              if (grantType == OpenIddictConstants.GrantTypes.Implicit)
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.Implicit);
-              }
-
-              if (grantType == OpenIddictConstants.GrantTypes.Password)
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.Password);
-              }
-
-              if (grantType == OpenIddictConstants.GrantTypes.RefreshToken)
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.RefreshToken);
-              }
-
-              if (grantType == OpenIddictConstants.GrantTypes.DeviceCode)
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.GrantTypes.DeviceCode);
-                  application.Permissions.Add(OpenIddictConstants.Permissions.Endpoints.Device);
-              }
-
-              if (grantType == OpenIddictConstants.GrantTypes.Implicit)
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.IdToken);
-                  if (string.Equals(type, OpenIddictConstants.ClientTypes.Public, StringComparison.OrdinalIgnoreCase))
-                  {
-                      application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.IdTokenToken);
-                      application.Permissions.Add(OpenIddictConstants.Permissions.ResponseTypes.Token);
-                  }
-              }
-
-              if (!buildInGrantTypes.Contains(grantType))
-              {
-                  application.Permissions.Add(OpenIddictConstants.Permissions.Prefixes.GrantType + grantType);
-              }
             }
+        }
 
-            var buildInScopes = new []
+        if (redirectUri != null)
-            {
+        {
-                OpenIddictConstants.Permissions.Scopes.Address,
+            if (!redirectUri.IsNullOrEmpty())
-                OpenIddictConstants.Permissions.Scopes.Email,
-                OpenIddictConstants.Permissions.Scopes.Phone,
-                OpenIddictConstants.Permissions.Scopes.Profile,
-                OpenIddictConstants.Permissions.Scopes.Roles
-            };
-
-            foreach (var scope in scopes)
             {
-                if (buildInScopes.Contains(scope))
+                if (!Uri.TryCreate(redirectUri, UriKind.Absolute, out var uri) || !uri.IsWellFormedOriginalString())
                 {
-                    application.Permissions.Add(scope);
+                    throw new BusinessException(L["InvalidRedirectUri", redirectUri]);
                 }
-                else
+
+                if (application.RedirectUris.All(x => x != uri))
                 {
-                    application.Permissions.Add(OpenIddictConstants.Permissions.Prefixes.Scope + scope);
+                    application.RedirectUris.Add(uri);
                 }
             }
+        }
 
-            if (redirectUri != null)
+        if (postLogoutRedirectUri != null)
+        {
+            if (!postLogoutRedirectUri.IsNullOrEmpty())
             {
-                if (!redirectUri.IsNullOrEmpty())
+                if (!Uri.TryCreate(postLogoutRedirectUri, UriKind.Absolute, out var uri) ||
+                    !uri.IsWellFormedOriginalString())
                 {
-                    if (!Uri.TryCreate(redirectUri, UriKind.Absolute, out var uri) || !uri.IsWellFormedOriginalString())
+                    throw new BusinessException(L["InvalidPostLogoutRedirectUri", postLogoutRedirectUri]);
-                    {
-                        throw new BusinessException(L["InvalidRedirectUri", redirectUri]);
-                    }
-
-                    if (application.RedirectUris.All(x => x != uri))
-                    {
-                        application.RedirectUris.Add(uri);
-                    }
                 }
-            }
 
-            if (postLogoutRedirectUri != null)
+                if (application.PostLogoutRedirectUris.All(x => x != uri))
-            {
-                if (!postLogoutRedirectUri.IsNullOrEmpty())
                 {
-                    if (!Uri.TryCreate(postLogoutRedirectUri, UriKind.Absolute, out var uri) || !uri.IsWellFormedOriginalString())
+                    application.PostLogoutRedirectUris.Add(uri);
-                    {
-                        throw new BusinessException(L["InvalidPostLogoutRedirectUri", postLogoutRedirectUri]);
-                    }
-
-                    if (application.PostLogoutRedirectUris.All(x => x != uri))
-                    {
-                        application.PostLogoutRedirectUris.Add(uri);
-                    }
                 }
             }
+        }
 
-            if (permissions != null)
+        if (permissions != null)
-            {
+        {
-                await _permissionDataSeeder.SeedAsync(
+            await _permissionDataSeeder.SeedAsync(
-                    ClientPermissionValueProvider.ProviderName,
+                ClientPermissionValueProvider.ProviderName,
-                    name,
+                name,
-                    permissions,
+                permissions,
-                    null
+                null
-                );
+            );
-            }
+        }
 
+        if (client == null)
+        {
             await _applicationManager.CreateAsync(application);
+            return;
+        }
+
+        if (!HasSameRedirectUris(client, application))
+        {
+            client.RedirectUris = JsonSerializer.Serialize(application.RedirectUris.Select(q => q.ToString().TrimEnd('/')));
+            client.PostLogoutRedirectUris = JsonSerializer.Serialize(application.PostLogoutRedirectUris.Select(q => q.ToString().TrimEnd('/')));
+
+            await _applicationManager.UpdateAsync(client.ToModel());
         }
+
+        if (!HasSameScopes(client, application))
+        {
+            client.Permissions = JsonSerializer.Serialize(application.Permissions.Select(q => q.ToString()));
+            await _applicationManager.UpdateAsync(client.ToModel());
+        }
+    }
+
+    private bool HasSameRedirectUris(OpenIddictApplication existingClient, AbpApplicationDescriptor application)
+    {
+        return existingClient.RedirectUris == JsonSerializer.Serialize(application.RedirectUris.Select(q => q.ToString().TrimEnd('/')));
+    }
+
+    private bool HasSameScopes(OpenIddictApplication existingClient, AbpApplicationDescriptor application)
+    {
+        return existingClient.Permissions == JsonSerializer.Serialize(application.Permissions.Select(q => q.ToString().TrimEnd('/')));
     }
-}
+}