Make the supported subject types configurable via OpenIddictServerOptions.SubjectTypes

src/OpenIddict.Abstractions/OpenIddictResources.resx

@@ -1569,6 +1569,9 @@ To apply post-logout redirection responses, create a class implementing 'IOpenId
   <data name="ID0420" xml:space="preserve">
     <value>The '{0}' client assertion type must be configured when enabling the '{1}' client authentication method.</value>
   </data>
+  <data name="ID0421" xml:space="preserve">
+    <value>At least one subject type must be supported.</value>
+  </data>
   <data name="ID2000" xml:space="preserve">
     <value>The security token is missing.</value>
   </data>

src/OpenIddict.Server/OpenIddictServerConfiguration.cs

@@ -151,6 +151,12 @@ public sealed class OpenIddictServerConfiguration : IPostConfigureOptions<OpenId
                 ClientAssertionTypes.JwtBearer, ClientAuthenticationMethods.ClientSecretJwt));
         }
 
+        // Ensure at least one supported subject type is listed.
+        if (options.SubjectTypes.Count is 0)
+        {
+            throw new InvalidOperationException(SR.GetResourceString(SR.ID0421));
+        }
+
         // Ensure reference tokens support was not enabled when token storage is disabled.
         if (options.DisableTokenStorage && (options.UseReferenceAccessTokens || options.UseReferenceRefreshTokens))
         {

src/OpenIddict.Server/OpenIddictServerHandlers.Discovery.cs

@@ -643,7 +643,7 @@ public static partial class OpenIddictServerHandlers
                     throw new ArgumentNullException(nameof(context));
                 }
 
-                context.SubjectTypes.Add(SubjectTypes.Public);
+                context.SubjectTypes.UnionWith(context.Options.SubjectTypes);
 
                 return default;
             }

src/OpenIddict.Server/OpenIddictServerOptions.cs

@@ -358,6 +358,15 @@ public sealed class OpenIddictServerOptions
     [EditorBrowsable(EditorBrowsableState.Advanced)]
     public HashSet<string> ResponseModes { get; } = new(StringComparer.Ordinal);
 
+    /// <summary>
+    /// Gets the OpenID Connect subject types enabled for this application.
+    /// </summary>
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    public HashSet<string> SubjectTypes { get; } = new(StringComparer.Ordinal)
+    {
+        OpenIddictConstants.SubjectTypes.Public
+    };
+
     /// <summary>
     /// Gets or sets a boolean indicating whether endpoint permissions should be ignored.
     /// Setting this property to <see langword="true"/> is NOT recommended.

test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Discovery.cs

@@ -794,7 +794,12 @@ public abstract partial class OpenIddictServerIntegrationTests
     public async Task HandleConfigurationRequest_SupportedSubjectTypesAreCorrectlyReturned()
     {
         // Arrange
-        await using var server = await CreateServerAsync();
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Configure(options => options.SubjectTypes.Remove(SubjectTypes.Public));
+            options.Configure(options => options.SubjectTypes.Add("custom"));
+        });
+
         await using var client = await server.CreateClientAsync();
 
         // Act
@@ -803,7 +808,7 @@ public abstract partial class OpenIddictServerIntegrationTests
 
         // Assert
         Assert.NotNull(types);
-        Assert.Contains(SubjectTypes.Public, types);
+        Assert.Equal("custom", Assert.Single(types));
     }
 
     [Theory]