Add `WildcardDomainSupport`.

modules/openiddict/app/OpenIddict.Demo.Server/OpenIddictServerModule.cs

@@ -21,6 +21,7 @@ using Volo.Abp.Modularity;
 using Volo.Abp.MultiTenancy;
 using Volo.Abp.OpenIddict;
 using Volo.Abp.OpenIddict.EntityFrameworkCore;
+using Volo.Abp.OpenIddict.WildcardDomains;
 using Volo.Abp.PermissionManagement;
 using Volo.Abp.PermissionManagement.EntityFrameworkCore;
 using Volo.Abp.PermissionManagement.HttpApi;
@@ -84,6 +85,12 @@ public class OpenIddictServerModule : AbpModule
             builder.AddSigningKey(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_C40DBB176E78")));
             builder.AddEncryptionKey(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_87E33FC57D80")));
         });
+
+        PreConfigure<AbpOpenIddictWildcardDomainOptions>(options =>
+        {
+            options.EnableWildcardDomainSupport = true;
+            options.WildcardDomainFormat = "https://{0}.abp.io/signin-oidc";
+        });
     }
 
     public override void ConfigureServices(ServiceConfigurationContext context)

modules/openiddict/src/Volo.Abp.OpenIddict.Domain/Volo/Abp/OpenIddict/AbpOpenIddictDomainModule.cs

@@ -1,7 +1,10 @@
-using System.Threading.Tasks;
+using System.Linq;
+using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Options;
 using OpenIddict.Abstractions;
+using OpenIddict.Server;
 using Volo.Abp.BackgroundWorkers;
 using Volo.Abp.Caching;
 using Volo.Abp.Domain;
@@ -12,6 +15,7 @@ using Volo.Abp.OpenIddict.Applications;
 using Volo.Abp.OpenIddict.Authorizations;
 using Volo.Abp.OpenIddict.Scopes;
 using Volo.Abp.OpenIddict.Tokens;
+using Volo.Abp.OpenIddict.WildcardDomains;
 using Volo.Abp.Security.Claims;
 using Volo.Abp.Threading;
 
@@ -47,7 +51,7 @@ public class AbpOpenIddictDomainModule : AbpModule
         }
     }
 
-    private static void AddOpenIddict(IServiceCollection services)
+    private void AddOpenIddict(IServiceCollection services)
     {
         var builderOptions = services.ExecutePreConfiguredActions<AbpOpenIddictOptions>();
 
@@ -126,6 +130,29 @@ public class AbpOpenIddictDomainModule : AbpModule
                         .AddDevelopmentSigningCertificate();
                 }
 
+                var wildcardDomainsOptions = services.ExecutePreConfiguredActions<AbpOpenIddictWildcardDomainOptions>();
+                if (wildcardDomainsOptions.EnableWildcardDomainSupport)
+                {
+                    var preActions = services.GetPreConfigureActions<AbpOpenIddictWildcardDomainOptions>();
+
+                    Configure<AbpOpenIddictWildcardDomainOptions>(options =>
+                    {
+                        preActions.Configure(options);
+                    });
+
+                    builder.RemoveEventHandler(OpenIddictServerHandlers.Authentication.ValidateClientRedirectUri.Descriptor);
+                    builder.AddEventHandler(AbpValidateClientRedirectUri.Descriptor);
+
+                    builder.RemoveEventHandler(OpenIddictServerHandlers.Authentication.ValidateRedirectUriParameter.Descriptor);
+                    builder.AddEventHandler(AbpValidateRedirectUriParameter.Descriptor);
+
+                    builder.RemoveEventHandler(OpenIddictServerHandlers.Session.ValidateClientPostLogoutRedirectUri.Descriptor);
+                    builder.AddEventHandler(AbpValidateClientPostLogoutRedirectUri.Descriptor);
+
+                    builder.RemoveEventHandler(OpenIddictServerHandlers.Session.ValidatePostLogoutRedirectUriParameter.Descriptor);
+                    builder.AddEventHandler(AbpValidatePostLogoutRedirectUriParameter.Descriptor);
+                }
+
                 services.ExecutePreConfiguredActions(builder);
             });
 

modules/openiddict/src/Volo.Abp.OpenIddict.Domain/Volo/Abp/OpenIddict/WildcardDomains/AbpOpenIddictWildcardDomainBase.cs

@@ -0,0 +1,42 @@
+using System;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using OpenIddict.Server;
+using Volo.Abp.Text.Formatting;
+
+namespace Volo.Abp.OpenIddict.WildcardDomains;
+
+public abstract class AbpOpenIddictWildcardDomainBase<THandler, TContext> : IOpenIddictServerHandler<TContext>
+    where THandler : class, new()
+    where TContext : OpenIddictServerEvents.BaseContext
+{
+    protected THandler Handler { get; set; }
+    protected AbpOpenIddictWildcardDomainOptions WildcardDomainOptions { get; }
+
+    protected AbpOpenIddictWildcardDomainBase(IOptions<AbpOpenIddictWildcardDomainOptions> wildcardDomainOptions, bool initHandler = true)
+    {
+        WildcardDomainOptions = wildcardDomainOptions.Value;
+        if (initHandler)
+        {
+            Handler = new THandler();
+        }
+    }
+
+    public abstract ValueTask HandleAsync(TContext context);
+
+    protected virtual Task<bool> CheckWildcardDomainAsync(string url)
+    {
+        var extractResult = FormattedStringValueExtracter.Extract(url, WildcardDomainOptions.WildcardDomainFormat, ignoreCase: true);
+        if (extractResult.IsMatch)
+        {
+            return Task.FromResult(true);
+        }
+
+        if (WildcardDomainOptions.WildcardDomainFormat.Replace("{0}.", "").IndexOf(url, StringComparison.OrdinalIgnoreCase) > 1)
+        {
+            return Task.FromResult(true);
+        }
+
+        return Task.FromResult(false);
+    }
+}

modules/openiddict/src/Volo.Abp.OpenIddict.Domain/Volo/Abp/OpenIddict/WildcardDomains/AbpOpenIddictWildcardDomainOptions.cs

@@ -0,0 +1,8 @@
+namespace Volo.Abp.OpenIddict.WildcardDomains;
+
+public class AbpOpenIddictWildcardDomainOptions
+{
+    public bool EnableWildcardDomainSupport { get; set; }
+
+    public string WildcardDomainFormat { get; set; }
+}

modules/openiddict/src/Volo.Abp.OpenIddict.Domain/Volo/Abp/OpenIddict/WildcardDomains/AbpValidateClientPostLogoutRedirectUri.cs

@@ -0,0 +1,39 @@
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using OpenIddict.Abstractions;
+using OpenIddict.Server;
+
+namespace Volo.Abp.OpenIddict.WildcardDomains;
+
+public class AbpValidateClientPostLogoutRedirectUri : AbpOpenIddictWildcardDomainBase<OpenIddictServerHandlers.Session.ValidateClientPostLogoutRedirectUri, OpenIddictServerEvents.ValidateLogoutRequestContext>
+{
+    public static OpenIddictServerHandlerDescriptor Descriptor { get; }
+        = OpenIddictServerHandlerDescriptor.CreateBuilder<OpenIddictServerEvents.ValidateLogoutRequestContext>()
+            .AddFilter<OpenIddictServerHandlerFilters.RequireDegradedModeDisabled>()
+            .AddFilter<OpenIddictServerHandlerFilters.RequirePostLogoutRedirectUriParameter>()
+            .UseScopedHandler<AbpValidateClientPostLogoutRedirectUri>()
+            .SetOrder(OpenIddictServerHandlers.Session.ValidatePostLogoutRedirectUriParameter.Descriptor.Order + 1_000)
+            .SetType(OpenIddictServerHandlerType.BuiltIn)
+            .Build();
+
+    public AbpValidateClientPostLogoutRedirectUri(
+        IOptions<AbpOpenIddictWildcardDomainOptions> wildcardDomainsOptions,
+        IOpenIddictApplicationManager applicationManager)
+        : base(wildcardDomainsOptions, false)
+    {
+        Handler = new OpenIddictServerHandlers.Session.ValidateClientPostLogoutRedirectUri(applicationManager);
+    }
+
+    public async override ValueTask HandleAsync(OpenIddictServerEvents.ValidateLogoutRequestContext context)
+    {
+        Check.NotNull(context, nameof(context));
+        Check.NotNullOrEmpty(context.PostLogoutRedirectUri, nameof(context.PostLogoutRedirectUri));
+
+        if (await CheckWildcardDomainAsync(context.PostLogoutRedirectUri))
+        {
+            return;
+        }
+
+        await Handler.HandleAsync(context);
+    }
+}

modules/openiddict/src/Volo.Abp.OpenIddict.Domain/Volo/Abp/OpenIddict/WildcardDomains/AbpValidateClientRedirectUri.cs

@@ -0,0 +1,37 @@
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using OpenIddict.Abstractions;
+using OpenIddict.Server;
+
+namespace Volo.Abp.OpenIddict.WildcardDomains;
+
+public class AbpValidateClientRedirectUri : AbpOpenIddictWildcardDomainBase<OpenIddictServerHandlers.Authentication.ValidateClientRedirectUri, OpenIddictServerEvents.ValidateAuthorizationRequestContext>
+{
+    public static OpenIddictServerHandlerDescriptor Descriptor { get; }
+        = OpenIddictServerHandlerDescriptor.CreateBuilder<OpenIddictServerEvents.ValidateAuthorizationRequestContext>()
+            .AddFilter<OpenIddictServerHandlerFilters.RequireDegradedModeDisabled>()
+            .UseScopedHandler<AbpValidateClientRedirectUri>()
+            .SetOrder(OpenIddictServerHandlers.Authentication.ValidateClientType.Descriptor.Order + 1_000)
+            .SetType(OpenIddictServerHandlerType.BuiltIn)
+            .Build();
+
+    public AbpValidateClientRedirectUri(
+        IOptions<AbpOpenIddictWildcardDomainOptions> wildcardDomainsOptions,
+        IOpenIddictApplicationManager applicationManager)
+        : base(wildcardDomainsOptions, false)
+    {
+        Handler = new OpenIddictServerHandlers.Authentication.ValidateClientRedirectUri(applicationManager);
+    }
+
+    public async override ValueTask HandleAsync(OpenIddictServerEvents.ValidateAuthorizationRequestContext context)
+    {
+        Check.NotNull(context, nameof(context));
+
+        if (!string.IsNullOrEmpty(context.RedirectUri) && await CheckWildcardDomainAsync(context.RedirectUri))
+        {
+            return;
+        }
+
+        await Handler.HandleAsync(context);
+    }
+}

modules/openiddict/src/Volo.Abp.OpenIddict.Domain/Volo/Abp/OpenIddict/WildcardDomains/AbpValidatePostLogoutRedirectUriParameter.cs

@@ -0,0 +1,32 @@
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using OpenIddict.Server;
+
+namespace Volo.Abp.OpenIddict.WildcardDomains;
+
+public class AbpValidatePostLogoutRedirectUriParameter : AbpOpenIddictWildcardDomainBase<OpenIddictServerHandlers.Session.ValidatePostLogoutRedirectUriParameter, OpenIddictServerEvents.ValidateLogoutRequestContext>
+{
+    public static OpenIddictServerHandlerDescriptor Descriptor { get; }
+        = OpenIddictServerHandlerDescriptor.CreateBuilder<OpenIddictServerEvents.ValidateLogoutRequestContext>()
+            .UseSingletonHandler<AbpValidatePostLogoutRedirectUriParameter>()
+            .SetOrder(int.MinValue + 100_000)
+            .SetType(OpenIddictServerHandlerType.BuiltIn)
+            .Build();
+
+    public AbpValidatePostLogoutRedirectUriParameter(IOptions<AbpOpenIddictWildcardDomainOptions> wildcardDomainsOptions)
+       : base(wildcardDomainsOptions)
+    {
+    }
+
+    public async override ValueTask HandleAsync(OpenIddictServerEvents.ValidateLogoutRequestContext context)
+    {
+        Check.NotNull(context, nameof(context));
+
+        if (string.IsNullOrEmpty(context.PostLogoutRedirectUri) || await CheckWildcardDomainAsync(context.PostLogoutRedirectUri))
+        {
+            return;
+        }
+
+        await Handler.HandleAsync(context);
+    }
+}

modules/openiddict/src/Volo.Abp.OpenIddict.Domain/Volo/Abp/OpenIddict/WildcardDomains/AbpValidateRedirectUriParameter.cs

@@ -0,0 +1,32 @@
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using OpenIddict.Server;
+
+namespace Volo.Abp.OpenIddict.WildcardDomains;
+
+public class AbpValidateRedirectUriParameter : AbpOpenIddictWildcardDomainBase<OpenIddictServerHandlers.Authentication.ValidateRedirectUriParameter, OpenIddictServerEvents.ValidateAuthorizationRequestContext>
+{
+    public static OpenIddictServerHandlerDescriptor Descriptor { get; }
+        = OpenIddictServerHandlerDescriptor.CreateBuilder<OpenIddictServerEvents.ValidateAuthorizationRequestContext>()
+            .UseSingletonHandler<AbpValidateRedirectUriParameter>()
+            .SetOrder(OpenIddictServerHandlers.Authentication.ValidateClientIdParameter.Descriptor.Order + 1_000)
+            .SetType(OpenIddictServerHandlerType.BuiltIn)
+            .Build();
+
+    public AbpValidateRedirectUriParameter(IOptions<AbpOpenIddictWildcardDomainOptions> wildcardDomainsOptions)
+        : base(wildcardDomainsOptions)
+    {
+    }
+
+    public async override ValueTask HandleAsync(OpenIddictServerEvents.ValidateAuthorizationRequestContext context)
+    {
+        Check.NotNull(context, nameof(context));
+
+        if (!string.IsNullOrEmpty(context.RedirectUri) && await CheckWildcardDomainAsync(context.RedirectUri))
+        {
+            return;
+        }
+
+        await Handler.HandleAsync(context);
+    }
+}