Introduce new FindAsync methods in OpenIddictTokenManager/IOpenIddictTokenStore

src/OpenIddict.Abstractions/Managers/IOpenIddictTokenManager.cs

@@ -81,6 +81,51 @@ namespace OpenIddict.Abstractions
         /// </returns>
         Task ExtendAsync([NotNull] object token, [CanBeNull] DateTimeOffset? date, CancellationToken cancellationToken = default);
 
+        /// <summary>
+        /// Retrieves the tokens corresponding to the specified
+        /// subject and associated with the application identifier.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the subject/client.
+        /// </returns>
+        Task<ImmutableArray<object>> FindAsync([NotNull] string subject,
+            [NotNull] string client, CancellationToken cancellationToken = default);
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        Task<ImmutableArray<object>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, CancellationToken cancellationToken = default);
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="type">The token type.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        Task<ImmutableArray<object>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type, CancellationToken cancellationToken = default);
+
         /// <summary>
         /// Retrieves the list of tokens corresponding to the specified application identifier.
         /// </summary>

src/OpenIddict.Abstractions/Stores/IOpenIddictAuthorizationStore.cs

@@ -107,6 +107,24 @@ namespace OpenIddict.Abstractions
             [NotNull] string subject, [NotNull] string client,
             [NotNull] string status, [NotNull] string type, CancellationToken cancellationToken);
 
+        /// <summary>
+        /// Retrieves the authorizations matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the authorization.</param>
+        /// <param name="client">The client associated with the authorization.</param>
+        /// <param name="status">The authorization status.</param>
+        /// <param name="type">The authorization type.</param>
+        /// <param name="scopes">The minimal scopes associated with the authorization.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the authorizations corresponding to the criteria.
+        /// </returns>
+        Task<ImmutableArray<TAuthorization>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type,
+            ImmutableArray<string> scopes, CancellationToken cancellationToken);
+
         /// <summary>
         /// Retrieves an authorization using its unique identifier.
         /// </summary>

src/OpenIddict.Abstractions/Stores/IOpenIddictTokenStore.cs

@@ -60,6 +60,50 @@ namespace OpenIddict.Abstractions
         /// <returns>A <see cref="Task"/> that can be used to monitor the asynchronous operation.</returns>
         Task DeleteAsync([NotNull] TToken token, CancellationToken cancellationToken);
 
+        /// <summary>
+        /// Retrieves the tokens corresponding to the specified
+        /// subject and associated with the application identifier.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the subject/client.
+        /// </returns>
+        Task<ImmutableArray<TToken>> FindAsync([NotNull] string subject, [NotNull] string client, CancellationToken cancellationToken);
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, CancellationToken cancellationToken);
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="type">The token type.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type, CancellationToken cancellationToken);
+
         /// <summary>
         /// Retrieves the list of tokens corresponding to the specified application identifier.
         /// </summary>

src/OpenIddict.Core/Managers/OpenIddictApplicationManager.cs

@@ -865,12 +865,6 @@ namespace OpenIddict.Core
                 await Store.SetClientSecretAsync(application, secret, cancellationToken);
             }
 
-            var results = await ValidateAsync(application, cancellationToken);
-            if (results.Any(result => result != ValidationResult.Success))
-            {
-                throw new ValidationException(results.FirstOrDefault(result => result != ValidationResult.Success), null, application);
-            }
-
             await UpdateAsync(application, cancellationToken);
         }
 

src/OpenIddict.Core/Managers/OpenIddictAuthorizationManager.cs

@@ -279,7 +279,7 @@ namespace OpenIddict.Core
         /// </returns>
         public virtual async Task<ImmutableArray<TAuthorization>> FindAsync(
             [NotNull] string subject, [NotNull] string client,
-            [NotNull] string status, CancellationToken cancellationToken)
+            [NotNull] string status, CancellationToken cancellationToken = default)
         {
             if (string.IsNullOrEmpty(subject))
             {
@@ -400,17 +400,42 @@ namespace OpenIddict.Core
             [NotNull] string status, [NotNull] string type,
             ImmutableArray<string> scopes, CancellationToken cancellationToken = default)
         {
-            var authorizations = await FindAsync(subject, client, status, type, cancellationToken);
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            if (string.IsNullOrEmpty(type))
+            {
+                throw new ArgumentException("The type cannot be null or empty.", nameof(type));
+            }
+
+            // SQL engines like Microsoft SQL Server or MySQL are known to use case-insensitive lookups by default.
+            // To ensure a case-sensitive comparison is enforced independently of the database/table/query collation
+            // used by the store, a second pass using string.Equals(StringComparison.Ordinal) is manually made here.
+
+            var authorizations = await Store.FindAsync(subject, client, status, type, scopes, cancellationToken);
             if (authorizations.IsEmpty)
             {
                 return ImmutableArray.Create<TAuthorization>();
             }
-            
+
             var builder = ImmutableArray.CreateBuilder<TAuthorization>(authorizations.Length);
 
             foreach (var authorization in authorizations)
             {
-                if (await HasScopesAsync(authorization, scopes, cancellationToken))
+                if (string.Equals(await Store.GetSubjectAsync(authorization, cancellationToken), subject, StringComparison.Ordinal)
+                    && await HasScopesAsync(authorization, scopes, cancellationToken))
                 {
                     builder.Add(authorization);
                 }
@@ -888,13 +913,6 @@ namespace OpenIddict.Core
             if (!string.Equals(status, OpenIddictConstants.Statuses.Revoked, StringComparison.OrdinalIgnoreCase))
             {
                 await Store.SetStatusAsync(authorization, OpenIddictConstants.Statuses.Revoked, cancellationToken);
-
-                var results = await ValidateAsync(authorization, cancellationToken);
-                if (results.Any(result => result != ValidationResult.Success))
-                {
-                    throw new ValidationException(results.FirstOrDefault(result => result != ValidationResult.Success), null, authorization);
-                }
-
                 await UpdateAsync(authorization, cancellationToken);
             }
         }

src/OpenIddict.Core/Managers/OpenIddictTokenManager.cs

@@ -179,6 +179,171 @@ namespace OpenIddict.Core
             await UpdateAsync(token, cancellationToken);
         }
 
+        /// <summary>
+        /// Retrieves the tokens corresponding to the specified
+        /// subject and associated with the application identifier.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the subject/client.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync([NotNull] string subject,
+            [NotNull] string client, CancellationToken cancellationToken = default)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            // SQL engines like Microsoft SQL Server or MySQL are known to use case-insensitive lookups by default.
+            // To ensure a case-sensitive comparison is enforced independently of the database/table/query collation
+            // used by the store, a second pass using string.Equals(StringComparison.Ordinal) is manually made here.
+
+            var tokens = await Store.FindAsync(subject, client, cancellationToken);
+            if (tokens.IsEmpty)
+            {
+                return ImmutableArray.Create<TToken>();
+            }
+
+            var builder = ImmutableArray.CreateBuilder<TToken>(tokens.Length);
+
+            foreach (var token in tokens)
+            {
+                if (string.Equals(await Store.GetSubjectAsync(token, cancellationToken), subject, StringComparison.Ordinal))
+                {
+                    builder.Add(token);
+                }
+            }
+
+            return builder.Count == builder.Capacity ?
+                builder.MoveToImmutable() :
+                builder.ToImmutable();
+        }
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, CancellationToken cancellationToken = default)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            // SQL engines like Microsoft SQL Server or MySQL are known to use case-insensitive lookups by default.
+            // To ensure a case-sensitive comparison is enforced independently of the database/table/query collation
+            // used by the store, a second pass using string.Equals(StringComparison.Ordinal) is manually made here.
+
+            var tokens = await Store.FindAsync(subject, client, status, cancellationToken);
+            if (tokens.IsEmpty)
+            {
+                return ImmutableArray.Create<TToken>();
+            }
+
+            var builder = ImmutableArray.CreateBuilder<TToken>(tokens.Length);
+
+            foreach (var token in tokens)
+            {
+                if (string.Equals(await Store.GetSubjectAsync(token, cancellationToken), subject, StringComparison.Ordinal))
+                {
+                    builder.Add(token);
+                }
+            }
+
+            return builder.Count == builder.Capacity ?
+                builder.MoveToImmutable() :
+                builder.ToImmutable();
+        }
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="type">The token type.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type, CancellationToken cancellationToken = default)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            if (string.IsNullOrEmpty(type))
+            {
+                throw new ArgumentException("The type cannot be null or empty.", nameof(type));
+            }
+
+            // SQL engines like Microsoft SQL Server or MySQL are known to use case-insensitive lookups by default.
+            // To ensure a case-sensitive comparison is enforced independently of the database/table/query collation
+            // used by the store, a second pass using string.Equals(StringComparison.Ordinal) is manually made here.
+
+            var tokens = await Store.FindAsync(subject, client, status, type, cancellationToken);
+            if (tokens.IsEmpty)
+            {
+                return ImmutableArray.Create<TToken>();
+            }
+
+            var builder = ImmutableArray.CreateBuilder<TToken>(tokens.Length);
+
+            foreach (var token in tokens)
+            {
+                if (string.Equals(await Store.GetSubjectAsync(token, cancellationToken), subject, StringComparison.Ordinal))
+                {
+                    builder.Add(token);
+                }
+            }
+
+            return builder.Count == builder.Capacity ?
+                builder.MoveToImmutable() :
+                builder.ToImmutable();
+        }
+
         /// <summary>
         /// Retrieves the list of tokens corresponding to the specified application identifier.
         /// </summary>
@@ -985,6 +1150,15 @@ namespace OpenIddict.Core
         Task IOpenIddictTokenManager.ExtendAsync(object token, DateTimeOffset? date, CancellationToken cancellationToken)
             => ExtendAsync((TToken) token, date, cancellationToken);
 
+        async Task<ImmutableArray<object>> IOpenIddictTokenManager.FindAsync(string subject, string client, CancellationToken cancellationToken)
+            => (await FindAsync(subject, client, cancellationToken)).CastArray<object>();
+
+        async Task<ImmutableArray<object>> IOpenIddictTokenManager.FindAsync(string subject, string client, string status, CancellationToken cancellationToken)
+            => (await FindAsync(subject, client, status, cancellationToken)).CastArray<object>();
+
+        async Task<ImmutableArray<object>> IOpenIddictTokenManager.FindAsync(string subject, string client, string status, string type, CancellationToken cancellationToken)
+            => (await FindAsync(subject, client, status, type, cancellationToken)).CastArray<object>();
+
         async Task<ImmutableArray<object>> IOpenIddictTokenManager.FindByApplicationIdAsync(string identifier, CancellationToken cancellationToken)
             => (await FindByApplicationIdAsync(identifier, cancellationToken)).CastArray<object>();
 

src/OpenIddict.EntityFramework/Stores/OpenIddictAuthorizationStore.cs

@@ -334,6 +334,50 @@ namespace OpenIddict.EntityFramework
                        select authorization).ToListAsync(cancellationToken));
         }
 
+        /// <summary>
+        /// Retrieves the authorizations matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the authorization.</param>
+        /// <param name="client">The client associated with the authorization.</param>
+        /// <param name="status">The authorization status.</param>
+        /// <param name="type">The authorization type.</param>
+        /// <param name="scopes">The minimal scopes associated with the authorization.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the authorizations corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TAuthorization>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type,
+            ImmutableArray<string> scopes, CancellationToken cancellationToken)
+        {
+            var authorizations = await FindAsync(subject, client, status, type, cancellationToken);
+            if (authorizations.IsEmpty)
+            {
+                return ImmutableArray.Create<TAuthorization>();
+            }
+
+            var builder = ImmutableArray.CreateBuilder<TAuthorization>(authorizations.Length);
+
+            foreach (var authorization in authorizations)
+            {
+                async Task<bool> HasScopesAsync()
+                    => (await GetScopesAsync(authorization, cancellationToken))
+                        .ToImmutableHashSet(StringComparer.Ordinal)
+                        .IsSupersetOf(scopes);
+
+                if (await HasScopesAsync())
+                {
+                    builder.Add(authorization);
+                }
+            }
+
+            return builder.Count == builder.Capacity ?
+                builder.MoveToImmutable() :
+                builder.ToImmutable();
+        }
+
         /// <summary>
         /// Retrieves an authorization using its unique identifier.
         /// </summary>

src/OpenIddict.EntityFramework/Stores/OpenIddictTokenStore.cs

@@ -180,6 +180,129 @@ namespace OpenIddict.EntityFramework
             }
         }
 
+        /// <summary>
+        /// Retrieves the tokens corresponding to the specified
+        /// subject and associated with the application identifier.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the subject/client.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync([NotNull] string subject,
+            [NotNull] string client, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client cannot be null or empty.", nameof(client));
+            }
+
+            var key = ConvertIdentifierFromString(client);
+
+            return ImmutableArray.CreateRange(
+                await (from token in Tokens.Include(token => token.Application).Include(token => token.Authorization)
+                       where token.Application != null &&
+                             token.Application.Id.Equals(key) &&
+                             token.Subject == subject
+                       select token).ToListAsync(cancellationToken));
+        }
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            var key = ConvertIdentifierFromString(client);
+
+            return ImmutableArray.CreateRange(
+                await (from token in Tokens.Include(token => token.Application).Include(token => token.Authorization)
+                       where token.Application != null &&
+                             token.Application.Id.Equals(key) &&
+                             token.Subject == subject &&
+                             token.Status == status
+                       select token).ToListAsync(cancellationToken));
+        }
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="type">The token type.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            if (string.IsNullOrEmpty(type))
+            {
+                throw new ArgumentException("The type cannot be null or empty.", nameof(type));
+            }
+
+            var key = ConvertIdentifierFromString(client);
+
+            return ImmutableArray.CreateRange(
+                await (from token in Tokens.Include(token => token.Application).Include(token => token.Authorization)
+                       where token.Application != null &&
+                             token.Application.Id.Equals(key) &&
+                             token.Subject == subject &&
+                             token.Status == status &&
+                             token.Type == type
+                       select token).ToListAsync(cancellationToken));
+        }
+
         /// <summary>
         /// Retrieves the list of tokens corresponding to the specified application identifier.
         /// </summary>

src/OpenIddict.EntityFrameworkCore/Configurations/OpenIddictAuthorizationConfiguration.cs

@@ -39,6 +39,12 @@ namespace OpenIddict.EntityFrameworkCore
 
             builder.HasKey(authorization => authorization.Id);
 
+            builder.HasIndex("ApplicationId",
+                nameof(OpenIddictAuthorization.Scopes),
+                nameof(OpenIddictAuthorization.Status),
+                nameof(OpenIddictAuthorization.Subject),
+                nameof(OpenIddictAuthorization.Type));
+
             builder.Property(authorization => authorization.ConcurrencyToken)
                    .IsConcurrencyToken();
 

src/OpenIddict.EntityFrameworkCore/Configurations/OpenIddictTokenConfiguration.cs

@@ -42,6 +42,11 @@ namespace OpenIddict.EntityFrameworkCore
             builder.HasIndex(token => token.ReferenceId)
                    .IsUnique();
 
+            builder.HasIndex("ApplicationId",
+                nameof(OpenIddictToken.Status),
+                nameof(OpenIddictToken.Subject),
+                nameof(OpenIddictToken.Type));
+
             builder.Property(token => token.ConcurrencyToken)
                    .IsConcurrencyToken();
 

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictAuthorizationStore.cs

@@ -405,6 +405,50 @@ namespace OpenIddict.EntityFrameworkCore
                 ConvertIdentifierFromString(client), subject, status, type).ToListAsync(cancellationToken));
         }
 
+        /// <summary>
+        /// Retrieves the authorizations matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the authorization.</param>
+        /// <param name="client">The client associated with the authorization.</param>
+        /// <param name="status">The authorization status.</param>
+        /// <param name="type">The authorization type.</param>
+        /// <param name="scopes">The minimal scopes associated with the authorization.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the authorizations corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TAuthorization>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type,
+            ImmutableArray<string> scopes, CancellationToken cancellationToken)
+        {
+            var authorizations = await FindAsync(subject, client, status, type, cancellationToken);
+            if (authorizations.IsEmpty)
+            {
+                return ImmutableArray.Create<TAuthorization>();
+            }
+
+            var builder = ImmutableArray.CreateBuilder<TAuthorization>(authorizations.Length);
+
+            foreach (var authorization in authorizations)
+            {
+                async Task<bool> HasScopesAsync()
+                    => (await GetScopesAsync(authorization, cancellationToken))
+                        .ToImmutableHashSet(StringComparer.Ordinal)
+                        .IsSupersetOf(scopes);
+
+                if (await HasScopesAsync())
+                {
+                    builder.Add(authorization);
+                }
+            }
+
+            return builder.Count == builder.Capacity ?
+                builder.MoveToImmutable() :
+                builder.ToImmutable();
+        }
+
         /// <summary>
         /// Exposes a compiled query allowing to retrieve an authorization using its unique identifier.
         /// </summary>

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictTokenStore.cs

@@ -202,6 +202,165 @@ namespace OpenIddict.EntityFrameworkCore
             }
         }
 
+        /// <summary>
+        /// Exposes a compiled query allowing to retrieve the tokens corresponding
+        /// to the specified subject and associated with the application identifier.
+        /// </summary>
+        private static readonly Func<TContext, TKey, string, AsyncEnumerable<TToken>> FindBySubjectAndClient =
+            // Note: due to a bug in Entity Framework Core's query visitor, the authorizations can't be
+            // filtered using token.Application.Id.Equals(key). To work around this issue,
+            // this compiled query uses an explicit join before applying the equality check.
+            // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
+            EF.CompileAsyncQuery((TContext context, TKey identifier, string subject) =>
+                from token in context.Set<TToken>()
+                    .Include(token => token.Application)
+                    .Include(token => token.Authorization)
+                    .AsTracking()
+                where token.Subject == subject
+                join application in context.Set<TApplication>().AsTracking() on token.Application.Id equals application.Id
+                where application.Id.Equals(identifier)
+                select token);
+
+        /// <summary>
+        /// Retrieves the tokens corresponding to the specified
+        /// subject and associated with the application identifier.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the subject/client.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync([NotNull] string subject,
+            [NotNull] string client, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client cannot be null or empty.", nameof(client));
+            }
+
+            return ImmutableArray.CreateRange(await FindBySubjectAndClient(Context,
+                ConvertIdentifierFromString(client), subject).ToListAsync(cancellationToken));
+        }
+
+        /// <summary>
+        /// Exposes a compiled query allowing to retrieve the tokens matching the specified parameters.
+        /// </summary>
+        private static readonly Func<TContext, TKey, string, string, AsyncEnumerable<TToken>> FindBySubjectClientAndStatus =
+            // Note: due to a bug in Entity Framework Core's query visitor, the authorizations can't be
+            // filtered using token.Application.Id.Equals(key). To work around this issue,
+            // this compiled query uses an explicit join before applying the equality check.
+            // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
+            EF.CompileAsyncQuery((TContext context, TKey identifier, string subject, string status) =>
+                from token in context.Set<TToken>()
+                    .Include(token => token.Application)
+                    .Include(token => token.Authorization)
+                    .AsTracking()
+                where token.Subject == subject && token.Status == status
+                join application in context.Set<TApplication>().AsTracking() on token.Application.Id equals application.Id
+                where application.Id.Equals(identifier)
+                select token);
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            return ImmutableArray.CreateRange(await FindBySubjectClientAndStatus(Context,
+                ConvertIdentifierFromString(client), subject, status).ToListAsync(cancellationToken));
+        }
+
+        /// <summary>
+        /// Exposes a compiled query allowing to retrieve the tokens matching the specified parameters.
+        /// </summary>
+        private static readonly Func<TContext, TKey, string, string, string, AsyncEnumerable<TToken>> FindBySubjectClientStatusAndType =
+            // Note: due to a bug in Entity Framework Core's query visitor, the authorizations can't be
+            // filtered using token.Application.Id.Equals(key). To work around this issue,
+            // this compiled query uses an explicit join before applying the equality check.
+            // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
+            EF.CompileAsyncQuery((TContext context, TKey identifier, string subject, string status, string type) =>
+                from token in context.Set<TToken>()
+                    .Include(token => token.Application)
+                    .Include(token => token.Authorization)
+                    .AsTracking()
+                where token.Subject == subject &&
+                      token.Status == status &&
+                      token.Type == type
+                join application in context.Set<TApplication>().AsTracking() on token.Application.Id equals application.Id
+                where application.Id.Equals(identifier)
+                select token);
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="type">The token type.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            if (string.IsNullOrEmpty(type))
+            {
+                throw new ArgumentException("The type cannot be null or empty.", nameof(type));
+            }
+
+            return ImmutableArray.CreateRange(await FindBySubjectClientStatusAndType(Context,
+                ConvertIdentifierFromString(client), subject, status, type).ToListAsync(cancellationToken));
+        }
+
         /// <summary>
         /// Exposes a compiled query allowing to retrieve the list of
         /// tokens corresponding to the specified application identifier.

src/OpenIddict.MongoDb/OpenIddictMongoDbContext.cs

@@ -61,8 +61,8 @@ namespace OpenIddict.MongoDb
                 {
                     throw new InvalidOperationException(new StringBuilder()
                         .AppendLine("The MongoDB database couldn't be initialized within a reasonable timeframe.")
-                        .Append("Make sure that the MongoDB server is ready and accepts connections from this machine ")
-                        .Append("or use 'options.UseMongoDb().SetInitializationTimeout()' to manually adjust the timeout.")
+                        .Append("Make sure that the MongoDB server is ready and accepts connections from this machine or use ")
+                        .Append("'services.AddOpenIddict().AddCore().UseMongoDb().SetInitializationTimeout()' to adjust the timeout.")
                         .ToString());
                 }
 
@@ -89,19 +89,43 @@ namespace OpenIddict.MongoDb
                         // Note: the cancellation token passed as a parameter is deliberately not used here to ensure
                         // the cancellation of a single store operation doesn't prevent the indexes from being created.
                         var applications = database.GetCollection<OpenIddictApplication>(options.ApplicationsCollectionName);
-                        await applications.Indexes.CreateOneAsync(new CreateIndexModel<OpenIddictApplication>(
-                            Builders<OpenIddictApplication>.IndexKeys.Ascending(application => application.ClientId),
+                        await applications.Indexes.CreateManyAsync(new[]
+                        {
+                            new CreateIndexModel<OpenIddictApplication>(
+                                Builders<OpenIddictApplication>.IndexKeys.Ascending(application => application.ClientId),
+                                new CreateIndexOptions
+                                {
+                                    Unique = true
+                                }),
+
+                            new CreateIndexModel<OpenIddictApplication>(
+                                Builders<OpenIddictApplication>.IndexKeys.Ascending(application => application.PostLogoutRedirectUris),
+                                new CreateIndexOptions
+                                {
+                                    Background = true
+                                }),
+
+                            new CreateIndexModel<OpenIddictApplication>(
+                                Builders<OpenIddictApplication>.IndexKeys.Ascending(application => application.RedirectUris),
+                                new CreateIndexOptions
+                                {
+                                    Background = true
+                                })
+                        });
+
+                        var authorizations = database.GetCollection<OpenIddictAuthorization>(options.AuthorizationsCollectionName);
+                        await authorizations.Indexes.CreateOneAsync(new CreateIndexModel<OpenIddictAuthorization>(
+                            Builders<OpenIddictAuthorization>.IndexKeys
+                                .Ascending(authorization => authorization.ApplicationId)
+                                .Ascending(authorization => authorization.Scopes)
+                                .Ascending(authorization => authorization.Status)
+                                .Ascending(authorization => authorization.Subject)
+                                .Ascending(authorization => authorization.Type),
                             new CreateIndexOptions
                             {
-                                Unique = true
+                                Background = true
                             }));
 
-                        await applications.Indexes.CreateOneAsync(new CreateIndexModel<OpenIddictApplication>(
-                            Builders<OpenIddictApplication>.IndexKeys.Ascending(application => application.PostLogoutRedirectUris)));
-
-                        await applications.Indexes.CreateOneAsync(new CreateIndexModel<OpenIddictApplication>(
-                            Builders<OpenIddictApplication>.IndexKeys.Ascending(application => application.RedirectUris)));
-
                         var scopes = database.GetCollection<OpenIddictScope>(options.ScopesCollectionName);
                         await scopes.Indexes.CreateOneAsync(new CreateIndexModel<OpenIddictScope>(
                             Builders<OpenIddictScope>.IndexKeys.Ascending(scope => scope.Name),
@@ -111,13 +135,27 @@ namespace OpenIddict.MongoDb
                             }));
 
                         var tokens = database.GetCollection<OpenIddictToken>(options.TokensCollectionName);
-                        await tokens.Indexes.CreateOneAsync(new CreateIndexModel<OpenIddictToken>(
-                            Builders<OpenIddictToken>.IndexKeys.Ascending(token => token.ReferenceId),
-                            new CreateIndexOptions<OpenIddictToken>
-                            {
-                                PartialFilterExpression = Builders<OpenIddictToken>.Filter.Exists(token => token.ReferenceId),
-                                Unique = true
-                            }));
+                        await tokens.Indexes.CreateManyAsync(new[]
+                        {
+                            new CreateIndexModel<OpenIddictToken>(
+                                Builders<OpenIddictToken>.IndexKeys.Ascending(token => token.ReferenceId),
+                                new CreateIndexOptions<OpenIddictToken>
+                                {
+                                    PartialFilterExpression = Builders<OpenIddictToken>.Filter.Exists(token => token.ReferenceId),
+                                    Unique = true
+                                }),
+
+                            new CreateIndexModel<OpenIddictToken>(
+                                Builders<OpenIddictToken>.IndexKeys
+                                    .Ascending(token => token.ApplicationId)
+                                    .Ascending(token => token.Status)
+                                    .Ascending(token => token.Subject)
+                                    .Ascending(token => token.Type),
+                                new CreateIndexOptions
+                                {
+                                    Background = true
+                                })
+                        });
                     }
 
                     return _database = database;

src/OpenIddict.MongoDb/OpenIddictMongoDbExtensions.cs

@@ -7,7 +7,6 @@
 using System;
 using JetBrains.Annotations;
 using Microsoft.Extensions.DependencyInjection.Extensions;
-using Microsoft.Extensions.Options;
 using OpenIddict.MongoDb;
 using OpenIddict.MongoDb.Models;
 
@@ -83,4 +82,4 @@ namespace Microsoft.Extensions.DependencyInjection
             return builder;
         }
     }
-}
+}

src/OpenIddict.MongoDb/Stores/OpenIddictAuthorizationStore.cs

@@ -265,6 +265,55 @@ namespace OpenIddict.MongoDb
                 authorization.Type == type).ToListAsync(cancellationToken));
         }
 
+        /// <summary>
+        /// Retrieves the authorizations matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the authorization.</param>
+        /// <param name="client">The client associated with the authorization.</param>
+        /// <param name="status">The authorization status.</param>
+        /// <param name="type">The authorization type.</param>
+        /// <param name="scopes">The minimal scopes associated with the authorization.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the authorizations corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TAuthorization>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type,
+            ImmutableArray<string> scopes, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            if (string.IsNullOrEmpty(type))
+            {
+                throw new ArgumentException("The type cannot be null or empty.", nameof(type));
+            }
+
+            var database = await Context.GetDatabaseAsync(cancellationToken);
+            var collection = database.GetCollection<TAuthorization>(Options.CurrentValue.AuthorizationsCollectionName);
+
+            return ImmutableArray.CreateRange(await collection.Find(authorization =>
+                authorization.Subject == subject &&
+                authorization.ApplicationId == ObjectId.Parse(client) &&
+                authorization.Status == status &&
+                authorization.Type == type &&
+                Enumerable.All(scopes, scope => authorization.Scopes.Contains(scope))).ToListAsync(cancellationToken));
+        }
+
         /// <summary>
         /// Retrieves an authorization using its unique identifier.
         /// </summary>

src/OpenIddict.MongoDb/Stores/OpenIddictTokenStore.cs

@@ -144,6 +144,123 @@ namespace OpenIddict.MongoDb
             }
         }
 
+        /// <summary>
+        /// Retrieves the tokens corresponding to the specified
+        /// subject and associated with the application identifier.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the subject/client.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync([NotNull] string subject,
+            [NotNull] string client, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client cannot be null or empty.", nameof(client));
+            }
+
+            var database = await Context.GetDatabaseAsync(cancellationToken);
+            var collection = database.GetCollection<TToken>(Options.CurrentValue.TokensCollectionName);
+
+            return ImmutableArray.CreateRange(await collection.Find(token =>
+                token.ApplicationId == ObjectId.Parse(client) &&
+                token.Subject == subject).ToListAsync(cancellationToken));
+        }
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            var database = await Context.GetDatabaseAsync(cancellationToken);
+            var collection = database.GetCollection<TToken>(Options.CurrentValue.TokensCollectionName);
+
+            return ImmutableArray.CreateRange(await collection.Find(token =>
+                token.ApplicationId == ObjectId.Parse(client) &&
+                token.Subject == subject &&
+                token.Status == status).ToListAsync(cancellationToken));
+        }
+
+        /// <summary>
+        /// Retrieves the tokens matching the specified parameters.
+        /// </summary>
+        /// <param name="subject">The subject associated with the token.</param>
+        /// <param name="client">The client associated with the token.</param>
+        /// <param name="status">The token status.</param>
+        /// <param name="type">The token type.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the tokens corresponding to the criteria.
+        /// </returns>
+        public virtual async Task<ImmutableArray<TToken>> FindAsync(
+            [NotNull] string subject, [NotNull] string client,
+            [NotNull] string status, [NotNull] string type, CancellationToken cancellationToken)
+        {
+            if (string.IsNullOrEmpty(subject))
+            {
+                throw new ArgumentException("The subject cannot be null or empty.", nameof(subject));
+            }
+
+            if (string.IsNullOrEmpty(client))
+            {
+                throw new ArgumentException("The client identifier cannot be null or empty.", nameof(client));
+            }
+
+            if (string.IsNullOrEmpty(status))
+            {
+                throw new ArgumentException("The status cannot be null or empty.", nameof(status));
+            }
+
+            if (string.IsNullOrEmpty(type))
+            {
+                throw new ArgumentException("The type cannot be null or empty.", nameof(type));
+            }
+
+            var database = await Context.GetDatabaseAsync(cancellationToken);
+            var collection = database.GetCollection<TToken>(Options.CurrentValue.TokensCollectionName);
+
+            return ImmutableArray.CreateRange(await collection.Find(token =>
+                token.ApplicationId == ObjectId.Parse(client) &&
+                token.Subject == subject &&
+                token.Status == status &&
+                token.Type == type).ToListAsync(cancellationToken));
+        }
+
         /// <summary>
         /// Retrieves the list of tokens corresponding to the specified application identifier.
         /// </summary>

src/OpenIddict.Server/Internal/OpenIddictServerProvider.cs

@@ -211,7 +211,7 @@ namespace OpenIddict.Server.Internal
             // Note: make sure the foreach statement iterates on a copy of the ticket
             // as the property collection is modified when the property is removed.
             var parameters = GetParameters(context.Request, context.Ticket.Properties);
-            foreach (var (property, parameter, value) in parameters.ToArray())
+            foreach (var (property, parameter, value) in parameters.ToList())
             {
                 context.Response.AddParameter(parameter, value);
                 context.Ticket.RemoveProperty(property);

test/OpenIddict.MongoDb.Tests/OpenIddictMongoDbContextTests.cs

@@ -5,6 +5,7 @@
  */
 
 using System;
+using System.Collections.Generic;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -48,11 +49,11 @@ namespace OpenIddict.MongoDb.Tests
             var provider = services.BuildServiceProvider();
 
             var manager = new Mock<IMongoIndexManager<OpenIddictApplication>>();
-            manager.Setup(mock => mock.CreateOneAsync(It.IsAny<CreateIndexModel<OpenIddictApplication>>(), It.IsAny<CreateOneIndexOptions>(), It.IsAny<CancellationToken>()))
+            manager.Setup(mock => mock.CreateManyAsync(It.IsAny<IEnumerable<CreateIndexModel<OpenIddictApplication>>>(), It.IsAny<CancellationToken>()))
                 .Returns(async delegate
                 {
                     await Task.Delay(TimeSpan.FromMilliseconds(1000));
-                    return nameof(OpenIddictMongoDbContextTests);
+                    return new[] { string.Empty };
                 });
 
             var collection = new Mock<IMongoCollection<OpenIddictApplication>>();
@@ -84,8 +85,8 @@ namespace OpenIddict.MongoDb.Tests
 
             Assert.Equal(new StringBuilder()
                 .AppendLine("The MongoDB database couldn't be initialized within a reasonable timeframe.")
-                .Append("Make sure that the MongoDB server is ready and accepts connections from this machine ")
-                .Append("or use 'options.UseMongoDb().SetInitializationTimeout()' to manually adjust the timeout.")
+                .Append("Make sure that the MongoDB server is ready and accepts connections from this machine or use ")
+                .Append("'services.AddOpenIddict().AddCore().UseMongoDb().SetInitializationTimeout()' to adjust the timeout.")
                 .ToString(), exception.Message);
         }
 
@@ -187,6 +188,7 @@ namespace OpenIddict.MongoDb.Tests
 
             // Assert
             database.Verify(mock => mock.GetCollection<OpenIddictApplication>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Never());
+            database.Verify(mock => mock.GetCollection<OpenIddictAuthorization>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Never());
             database.Verify(mock => mock.GetCollection<OpenIddictScope>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Never());
             database.Verify(mock => mock.GetCollection<OpenIddictToken>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Never());
         }
@@ -212,6 +214,7 @@ namespace OpenIddict.MongoDb.Tests
             Assert.Same(database.Object, await context.GetDatabaseAsync(CancellationToken.None));
 
             database.Verify(mock => mock.GetCollection<OpenIddictApplication>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Once());
+            database.Verify(mock => mock.GetCollection<OpenIddictAuthorization>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Once());
             database.Verify(mock => mock.GetCollection<OpenIddictScope>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Once());
             database.Verify(mock => mock.GetCollection<OpenIddictToken>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Once());
         }
@@ -255,6 +258,7 @@ namespace OpenIddict.MongoDb.Tests
             Assert.Same(database.Object, await context.GetDatabaseAsync(CancellationToken.None));
 
             database.Verify(mock => mock.GetCollection<OpenIddictApplication>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Exactly(2));
+            database.Verify(mock => mock.GetCollection<OpenIddictAuthorization>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Once());
             database.Verify(mock => mock.GetCollection<OpenIddictScope>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Once());
             database.Verify(mock => mock.GetCollection<OpenIddictToken>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()), Times.Once());
         }
@@ -265,6 +269,10 @@ namespace OpenIddict.MongoDb.Tests
             applications.SetupGet(mock => mock.Indexes)
                 .Returns(Mock.Of<IMongoIndexManager<OpenIddictApplication>>());
 
+            var authorizations = new Mock<IMongoCollection<OpenIddictAuthorization>>();
+            authorizations.SetupGet(mock => mock.Indexes)
+                .Returns(Mock.Of<IMongoIndexManager<OpenIddictAuthorization>>());
+
             var scopes = new Mock<IMongoCollection<OpenIddictScope>>();
             scopes.SetupGet(mock => mock.Indexes)
                 .Returns(Mock.Of<IMongoIndexManager<OpenIddictScope>>());
@@ -276,6 +284,8 @@ namespace OpenIddict.MongoDb.Tests
             var database = new Mock<IMongoDatabase>();
             database.Setup(mock => mock.GetCollection<OpenIddictApplication>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()))
                 .Returns(applications.Object);
+            database.Setup(mock => mock.GetCollection<OpenIddictAuthorization>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()))
+                .Returns(authorizations.Object);
             database.Setup(mock => mock.GetCollection<OpenIddictScope>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()))
                 .Returns(scopes.Object);
             database.Setup(mock => mock.GetCollection<OpenIddictToken>(It.IsAny<string>(), It.IsAny<MongoCollectionSettings>()))