diff --git a/src/OpenIddict.Abstractions/OpenIddictResources.resx b/src/OpenIddict.Abstractions/OpenIddictResources.resx
index 224c56cf..0dac8974 100644
--- a/src/OpenIddict.Abstractions/OpenIddictResources.resx
+++ b/src/OpenIddict.Abstractions/OpenIddictResources.resx
@@ -1319,6 +1319,9 @@ Alternatively, you can disable the token storage feature by calling 'services.Ad
The endpoint type associated with the state token cannot be resolved.
+
+ No issuer was specified in the sign-out properties. When multiple clients are registered, an issuer must be specified in the sign-out properties.
+
The security token is missing.
diff --git a/src/OpenIddict.Client/OpenIddictClientHandlers.cs b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
index 0684cfb7..e5adb13a 100644
--- a/src/OpenIddict.Client/OpenIddictClientHandlers.cs
+++ b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
@@ -4468,6 +4468,16 @@ public static partial class OpenIddictClientHandlers
throw new InvalidOperationException(SR.GetResourceString(SR.ID0024));
}
+ // If no issuer was explicitly attached and a single client is registered, use it.
+ // Otherwise, throw an exception to indicate that setting an explicit issuer
+ // is required when multiple clients are registered.
+ context.Issuer ??= context.Options.Registrations.Count switch
+ {
+ 0 => throw new InvalidOperationException(SR.GetResourceString(SR.ID0304)),
+ 1 => context.Options.Registrations[0].Issuer,
+ _ => throw new InvalidOperationException(SR.GetResourceString(SR.ID0341))
+ };
+
return default;
}
}