Update OpenIddictAuthorizationStore/OpenIddictTokenStore to avoid throwing exceptions when no application or authorization is specified

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictAuthorizationStore.cs

@@ -125,21 +125,26 @@ namespace OpenIddict.EntityFrameworkCore
                 throw new ArgumentNullException(nameof(descriptor));
             }
 
-            var key = ConvertIdentifierFromString(descriptor.ApplicationId);
-
-            var application = await Applications.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
-            if (application == null)
-            {
-                throw new InvalidOperationException("The application associated with the authorization cannot be found.");
-            }
-
             var authorization = new TAuthorization
             {
-                Application = application,
                 Scope = string.Join(" ", descriptor.Scopes),
                 Subject = descriptor.Subject
             };
 
+            // Bind the authorization to the specified application, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
+            {
+                var key = ConvertIdentifierFromString(descriptor.ApplicationId);
+
+                var application = await Applications.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                if (application == null)
+                {
+                    throw new InvalidOperationException("The application associated with the authorization cannot be found.");
+                }
+
+                authorization.Application = application;
+            }
+
             return await CreateAsync(authorization, cancellationToken);
         }
 

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictTokenStore.cs

@@ -139,27 +139,33 @@ namespace OpenIddict.EntityFrameworkCore
                 Type = descriptor.Type
             };
 
-            // Bind the token to the specified client application.
-            var key = ConvertIdentifierFromString(descriptor.ApplicationId);
-
-            var application = await Applications.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
-            if (application == null)
+            // Bind the token to the specified client application, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
             {
-                throw new InvalidOperationException("The application associated with the token cannot be found.");
-            }
+                var key = ConvertIdentifierFromString(descriptor.ApplicationId);
 
-            token.Application = application;
+                var application = await Applications.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                if (application == null)
+                {
+                    throw new InvalidOperationException("The application associated with the token cannot be found.");
+                }
 
-            // Bind the token to the specified authorization.
-            key = ConvertIdentifierFromString(descriptor.AuthorizationId);
+                token.Application = application;
+            }
 
-            var authorization = await Authorizations.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
-            if (authorization == null)
+            // Bind the token to the specified authorization, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.AuthorizationId))
             {
-                throw new InvalidOperationException("The authorization associated with the token cannot be found.");
-            }
+                var key = ConvertIdentifierFromString(descriptor.AuthorizationId);
 
-            token.Authorization = authorization;
+                var authorization = await Authorizations.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                if (authorization == null)
+                {
+                    throw new InvalidOperationException("The authorization associated with the token cannot be found.");
+                }
+
+                token.Authorization = authorization;
+            }
 
             return await CreateAsync(token, cancellationToken);
         }