Flow the claims principal/authentication properties from the OpenIddict provider to the authorizations/tokens stores

src/OpenIddict.Core/Descriptors/OpenIddictAuthorizationDescriptor.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Security.Claims;
 
 namespace OpenIddict.Core
 {
@@ -13,6 +14,19 @@ namespace OpenIddict.Core
         /// </summary>
         public string ApplicationId { get; set; }
 
+        /// <summary>
+        /// Gets or sets the optional principal associated with the authorization.
+        /// Note: this property is not stored by the default authorization stores.
+        /// </summary>
+        public ClaimsPrincipal Principal { get; set; }
+
+        /// <summary>
+        /// Gets the optional authentication properties associated with the authorization.
+        /// Note: this property is not stored by the default authorization stores.
+        /// </summary>
+        public IDictionary<string, string> Properties { get; } =
+            new Dictionary<string, string>(StringComparer.Ordinal);
+
         /// <summary>
         /// Gets the scopes associated with the authorization.
         /// </summary>

src/OpenIddict.Core/Descriptors/OpenIddictScopeDescriptor.cs

@@ -5,6 +5,12 @@
     /// </summary>
     public class OpenIddictScopeDescriptor
     {
+        /// <summary>
+        /// Gets or sets the description
+        /// associated with the scope.
+        /// </summary>
+        public virtual string Description { get; set; }
+
         /// <summary>
         /// Gets or sets the unique name
         /// associated with the scope.

src/OpenIddict.Core/Descriptors/OpenIddictTokenDescriptor.cs

@@ -1,4 +1,6 @@
 using System;
+using System.Collections.Generic;
+using System.Security.Claims;
 
 namespace OpenIddict.Core
 {
@@ -37,6 +39,19 @@ namespace OpenIddict.Core
         /// </summary>
         public string Hash { get; set; }
 
+        /// <summary>
+        /// Gets or sets the optional principal associated with the token.
+        /// Note: this property is not stored by the default token stores.
+        /// </summary>
+        public ClaimsPrincipal Principal { get; set; }
+
+        /// <summary>
+        /// Gets the optional authentication properties associated with the token.
+        /// Note: this property is not stored by the default token stores.
+        /// </summary>
+        public IDictionary<string, string> Properties { get; } =
+            new Dictionary<string, string>(StringComparer.Ordinal);
+
         /// <summary>
         /// Gets or sets the status associated with the token.
         /// </summary>

src/OpenIddict.Core/Stores/OpenIddictAuthorizationStore.cs

@@ -380,7 +380,7 @@ namespace OpenIddict.Core
 
             authorization.Type = type;
 
-            return Task.FromResult(0);
+            return Task.CompletedTask;
         }
 
         /// <summary>

src/OpenIddict.EntityFramework/Stores/OpenIddictApplicationStore.cs

@@ -141,36 +141,17 @@ namespace OpenIddict.EntityFramework
         /// <returns>
         /// A <see cref="Task"/> that can be used to monitor the asynchronous operation, whose result returns the application.
         /// </returns>
-        public override Task<TApplication> CreateAsync([NotNull] OpenIddictApplicationDescriptor descriptor, CancellationToken cancellationToken)
+        public override async Task<TApplication> CreateAsync([NotNull] OpenIddictApplicationDescriptor descriptor, CancellationToken cancellationToken)
         {
             if (descriptor == null)
             {
                 throw new ArgumentNullException(nameof(descriptor));
             }
 
-            var application = new TApplication
-            {
-                ClientId = descriptor.ClientId,
-                ClientSecret = descriptor.ClientSecret,
-                DisplayName = descriptor.DisplayName,
-                Type = descriptor.Type
-            };
-
-            if (descriptor.PostLogoutRedirectUris.Count != 0)
-            {
-                application.PostLogoutRedirectUris = string.Join(
-                    OpenIddictConstants.Separators.Space,
-                    descriptor.PostLogoutRedirectUris.Select(uri => uri.OriginalString));
-            }
-
-            if (descriptor.RedirectUris.Count != 0)
-            {
-                application.RedirectUris = string.Join(
-                    OpenIddictConstants.Separators.Space,
-                    descriptor.RedirectUris.Select(uri => uri.OriginalString));
-            }
+            var application = new TApplication();
 
-            return CreateAsync(application, cancellationToken);
+            await BindAsync(application, descriptor, cancellationToken);
+            return await CreateAsync(application, cancellationToken);
         }
 
         /// <summary>
@@ -304,5 +285,48 @@ namespace OpenIddict.EntityFramework
 
             return Context.SaveChangesAsync(cancellationToken);
         }
+
+        /// <summary>
+        /// Sets the application properties based on the specified descriptor.
+        /// </summary>
+        /// <param name="application">The application to update.</param>
+        /// <param name="descriptor">The application descriptor.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation.
+        /// </returns>
+        protected virtual Task BindAsync([NotNull] TApplication application, [NotNull] OpenIddictApplicationDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            if (application == null)
+            {
+                throw new ArgumentNullException(nameof(application));
+            }
+
+            if (descriptor == null)
+            {
+                throw new ArgumentNullException(nameof(descriptor));
+            }
+
+            application.ClientId = descriptor.ClientId;
+            application.ClientSecret = descriptor.ClientSecret;
+            application.DisplayName = descriptor.DisplayName;
+            application.Type = descriptor.Type;
+
+            if (descriptor.PostLogoutRedirectUris.Count != 0)
+            {
+                application.PostLogoutRedirectUris = string.Join(
+                    OpenIddictConstants.Separators.Space,
+                    descriptor.PostLogoutRedirectUris.Select(uri => uri.OriginalString));
+            }
+
+            if (descriptor.RedirectUris.Count != 0)
+            {
+                application.RedirectUris = string.Join(
+                    OpenIddictConstants.Separators.Space,
+                    descriptor.RedirectUris.Select(uri => uri.OriginalString));
+            }
+
+            return Task.CompletedTask;
+        }
     }
 }

src/OpenIddict.EntityFramework/Stores/OpenIddictAuthorizationStore.cs

@@ -148,30 +148,9 @@ namespace OpenIddict.EntityFramework
                 throw new ArgumentNullException(nameof(descriptor));
             }
 
-            var authorization = new TAuthorization
-            {
-                Status = descriptor.Status,
-                Subject = descriptor.Subject,
-                Type = descriptor.Type
-            };
-
-            if (descriptor.Scopes.Count != 0)
-            {
-                authorization.Scopes = string.Join(OpenIddictConstants.Separators.Space, descriptor.Scopes);
-            }
-
-            // Bind the authorization to the specified application, if applicable.
-            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
-            {
-                var application = await Applications.FindAsync(cancellationToken, ConvertIdentifierFromString(descriptor.ApplicationId));
-                if (application == null)
-                {
-                    throw new InvalidOperationException("The application associated with the authorization cannot be found.");
-                }
-
-                authorization.Application = application;
-            }
+            var authorization = new TAuthorization();
 
+            await BindAsync(authorization, descriptor, cancellationToken);
             return await CreateAsync(authorization, cancellationToken);
         }
 
@@ -356,5 +335,48 @@ namespace OpenIddict.EntityFramework
 
             return Context.SaveChangesAsync(cancellationToken);
         }
+
+        /// <summary>
+        /// Sets the authorization properties based on the specified descriptor.
+        /// </summary>
+        /// <param name="authorization">The authorization to update.</param>
+        /// <param name="descriptor">The authorization descriptor.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation.
+        /// </returns>
+        protected virtual async Task BindAsync([NotNull] TAuthorization authorization, [NotNull] OpenIddictAuthorizationDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            if (authorization == null)
+            {
+                throw new ArgumentNullException(nameof(authorization));
+            }
+
+            if (descriptor == null)
+            {
+                throw new ArgumentNullException(nameof(descriptor));
+            }
+
+            authorization.Status = descriptor.Status;
+            authorization.Subject = descriptor.Subject;
+            authorization.Type = descriptor.Type;
+
+            if (descriptor.Scopes.Count != 0)
+            {
+                authorization.Scopes = string.Join(OpenIddictConstants.Separators.Space, descriptor.Scopes);
+            }
+
+            // Bind the authorization to the specified application, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
+            {
+                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.ApplicationId) }, cancellationToken);
+                if (application == null)
+                {
+                    throw new InvalidOperationException("The application associated with the authorization cannot be found.");
+                }
+
+                authorization.Application = application;
+            }
+        }
     }
 }

src/OpenIddict.EntityFramework/Stores/OpenIddictScopeStore.cs

@@ -122,14 +122,12 @@ namespace OpenIddict.EntityFramework
         /// <returns>
         /// A <see cref="Task"/> that can be used to monitor the asynchronous operation, whose result returns the scope.
         /// </returns>
-        public override Task<TScope> CreateAsync([NotNull] OpenIddictScopeDescriptor descriptor, CancellationToken cancellationToken)
+        public override async Task<TScope> CreateAsync([NotNull] OpenIddictScopeDescriptor descriptor, CancellationToken cancellationToken)
         {
-            var scope = new TScope
-            {
-                Name = descriptor.Name
-            };
+            var scope = new TScope();
 
-            return CreateAsync(scope, cancellationToken);
+            await BindAsync(scope, descriptor, cancellationToken);
+            return await CreateAsync(scope, cancellationToken);
         }
 
         /// <summary>
@@ -212,5 +210,32 @@ namespace OpenIddict.EntityFramework
 
             return Context.SaveChangesAsync(cancellationToken);
         }
+
+        /// <summary>
+        /// Sets the scope properties based on the specified descriptor.
+        /// </summary>
+        /// <param name="scope">The scope to update.</param>
+        /// <param name="descriptor">The scope descriptor.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation.
+        /// </returns>
+        protected virtual Task BindAsync([NotNull] TScope scope, [NotNull] OpenIddictScopeDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            if (scope == null)
+            {
+                throw new ArgumentNullException(nameof(scope));
+            }
+
+            if (descriptor == null)
+            {
+                throw new ArgumentNullException(nameof(descriptor));
+            }
+
+            scope.Description = descriptor.Description;
+            scope.Name = descriptor.Name;
+
+            return Task.CompletedTask;
+        }
     }
 }

src/OpenIddict.EntityFramework/Stores/OpenIddictTokenStore.cs

@@ -148,41 +148,9 @@ namespace OpenIddict.EntityFramework
                 throw new ArgumentNullException(nameof(descriptor));
             }
 
-            var token = new TToken
-            {
-                Ciphertext = descriptor.Ciphertext,
-                CreationDate = descriptor.CreationDate,
-                ExpirationDate = descriptor.ExpirationDate,
-                Hash = descriptor.Hash,
-                Status = descriptor.Status,
-                Subject = descriptor.Subject,
-                Type = descriptor.Type
-            };
-
-            // Bind the token to the specified client application, if applicable.
-            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
-            {
-                var application = await Applications.FindAsync(cancellationToken, ConvertIdentifierFromString(descriptor.ApplicationId));
-                if (application == null)
-                {
-                    throw new InvalidOperationException("The application associated with the token cannot be found.");
-                }
-
-                token.Application = application;
-            }
-
-            // Bind the token to the specified authorization, if applicable.
-            if (!string.IsNullOrEmpty(descriptor.AuthorizationId))
-            {
-                var authorization = await Authorizations.FindAsync(cancellationToken, ConvertIdentifierFromString(descriptor.AuthorizationId));
-                if (authorization == null)
-                {
-                    throw new InvalidOperationException("The authorization associated with the token cannot be found.");
-                }
-
-                token.Authorization = authorization;
-            }
+            var token = new TToken();
 
+            await BindAsync(token, descriptor, cancellationToken);
             return await CreateAsync(token, cancellationToken);
         }
 
@@ -429,5 +397,59 @@ namespace OpenIddict.EntityFramework
 
             return Context.SaveChangesAsync(cancellationToken);
         }
+
+        /// <summary>
+        /// Sets the token properties based on the specified descriptor.
+        /// </summary>
+        /// <param name="token">The token to update.</param>
+        /// <param name="descriptor">The token descriptor.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation.
+        /// </returns>
+        protected virtual async Task BindAsync([NotNull] TToken token, [NotNull] OpenIddictTokenDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            if (token == null)
+            {
+                throw new ArgumentNullException(nameof(token));
+            }
+
+            if (descriptor == null)
+            {
+                throw new ArgumentNullException(nameof(descriptor));
+            }
+
+            token.Ciphertext = descriptor.Ciphertext;
+            token.CreationDate = descriptor.CreationDate;
+            token.ExpirationDate = descriptor.ExpirationDate;
+            token.Hash = descriptor.Hash;
+            token.Status = descriptor.Status;
+            token.Subject = descriptor.Subject;
+            token.Type = descriptor.Type;
+
+            // Bind the token to the specified client application, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
+            {
+                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.ApplicationId) }, cancellationToken);
+                if (application == null)
+                {
+                    throw new InvalidOperationException("The application associated with the token cannot be found.");
+                }
+
+                token.Application = application;
+            }
+
+            // Bind the token to the specified authorization, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.AuthorizationId))
+            {
+                var authorization = await Authorizations.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.AuthorizationId) }, cancellationToken);
+                if (authorization == null)
+                {
+                    throw new InvalidOperationException("The authorization associated with the token cannot be found.");
+                }
+
+                token.Authorization = authorization;
+            }
+        }
     }
 }

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictApplicationStore.cs

@@ -141,36 +141,17 @@ namespace OpenIddict.EntityFrameworkCore
         /// <returns>
         /// A <see cref="Task"/> that can be used to monitor the asynchronous operation, whose result returns the application.
         /// </returns>
-        public override Task<TApplication> CreateAsync([NotNull] OpenIddictApplicationDescriptor descriptor, CancellationToken cancellationToken)
+        public override async Task<TApplication> CreateAsync([NotNull] OpenIddictApplicationDescriptor descriptor, CancellationToken cancellationToken)
         {
             if (descriptor == null)
             {
                 throw new ArgumentNullException(nameof(descriptor));
             }
 
-            var application = new TApplication
-            {
-                ClientId = descriptor.ClientId,
-                ClientSecret = descriptor.ClientSecret,
-                DisplayName = descriptor.DisplayName,
-                Type = descriptor.Type
-            };
-
-            if (descriptor.PostLogoutRedirectUris.Count != 0)
-            {
-                application.PostLogoutRedirectUris = string.Join(
-                    OpenIddictConstants.Separators.Space,
-                    descriptor.PostLogoutRedirectUris.Select(uri => uri.OriginalString));
-            }
-
-            if (descriptor.RedirectUris.Count != 0)
-            {
-                application.RedirectUris = string.Join(
-                    OpenIddictConstants.Separators.Space,
-                    descriptor.RedirectUris.Select(uri => uri.OriginalString));
-            }
+            var application = new TApplication();
 
-            return CreateAsync(application, cancellationToken);
+            await BindAsync(application, descriptor, cancellationToken);
+            return await CreateAsync(application, cancellationToken);
         }
 
         /// <summary>
@@ -304,5 +285,48 @@ namespace OpenIddict.EntityFrameworkCore
 
             return Context.SaveChangesAsync(cancellationToken);
         }
+
+        /// <summary>
+        /// Sets the application properties based on the specified descriptor.
+        /// </summary>
+        /// <param name="application">The application to update.</param>
+        /// <param name="descriptor">The application descriptor.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation.
+        /// </returns>
+        protected virtual Task BindAsync([NotNull] TApplication application, [NotNull] OpenIddictApplicationDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            if (application == null)
+            {
+                throw new ArgumentNullException(nameof(application));
+            }
+
+            if (descriptor == null)
+            {
+                throw new ArgumentNullException(nameof(descriptor));
+            }
+
+            application.ClientId = descriptor.ClientId;
+            application.ClientSecret = descriptor.ClientSecret;
+            application.DisplayName = descriptor.DisplayName;
+            application.Type = descriptor.Type;
+
+            if (descriptor.PostLogoutRedirectUris.Count != 0)
+            {
+                application.PostLogoutRedirectUris = string.Join(
+                    OpenIddictConstants.Separators.Space,
+                    descriptor.PostLogoutRedirectUris.Select(uri => uri.OriginalString));
+            }
+
+            if (descriptor.RedirectUris.Count != 0)
+            {
+                application.RedirectUris = string.Join(
+                    OpenIddictConstants.Separators.Space,
+                    descriptor.RedirectUris.Select(uri => uri.OriginalString));
+            }
+
+            return Task.CompletedTask;
+        }
     }
 }

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictAuthorizationStore.cs

@@ -148,30 +148,9 @@ namespace OpenIddict.EntityFrameworkCore
                 throw new ArgumentNullException(nameof(descriptor));
             }
 
-            var authorization = new TAuthorization
-            {
-                Status = descriptor.Status,
-                Subject = descriptor.Subject,
-                Type = descriptor.Type
-            };
-
-            if (descriptor.Scopes.Count != 0)
-            {
-                authorization.Scopes = string.Join(OpenIddictConstants.Separators.Space, descriptor.Scopes);
-            }
-
-            // Bind the authorization to the specified application, if applicable.
-            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
-            {
-                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.ApplicationId) }, cancellationToken);
-                if (application == null)
-                {
-                    throw new InvalidOperationException("The application associated with the authorization cannot be found.");
-                }
-
-                authorization.Application = application;
-            }
+            var authorization = new TAuthorization();
 
+            await BindAsync(authorization, descriptor, cancellationToken);
             return await CreateAsync(authorization, cancellationToken);
         }
 
@@ -356,5 +335,48 @@ namespace OpenIddict.EntityFrameworkCore
 
             return Context.SaveChangesAsync(cancellationToken);
         }
+
+        /// <summary>
+        /// Sets the authorization properties based on the specified descriptor.
+        /// </summary>
+        /// <param name="authorization">The authorization to update.</param>
+        /// <param name="descriptor">The authorization descriptor.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation.
+        /// </returns>
+        protected virtual async Task BindAsync([NotNull] TAuthorization authorization, [NotNull] OpenIddictAuthorizationDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            if (authorization == null)
+            {
+                throw new ArgumentNullException(nameof(authorization));
+            }
+
+            if (descriptor == null)
+            {
+                throw new ArgumentNullException(nameof(descriptor));
+            }
+
+            authorization.Status = descriptor.Status;
+            authorization.Subject = descriptor.Subject;
+            authorization.Type = descriptor.Type;
+
+            if (descriptor.Scopes.Count != 0)
+            {
+                authorization.Scopes = string.Join(OpenIddictConstants.Separators.Space, descriptor.Scopes);
+            }
+
+            // Bind the authorization to the specified application, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
+            {
+                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.ApplicationId) }, cancellationToken);
+                if (application == null)
+                {
+                    throw new InvalidOperationException("The application associated with the authorization cannot be found.");
+                }
+
+                authorization.Application = application;
+            }
+        }
     }
 }

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictScopeStore.cs

@@ -122,14 +122,12 @@ namespace OpenIddict.EntityFrameworkCore
         /// <returns>
         /// A <see cref="Task"/> that can be used to monitor the asynchronous operation, whose result returns the scope.
         /// </returns>
-        public override Task<TScope> CreateAsync([NotNull] OpenIddictScopeDescriptor descriptor, CancellationToken cancellationToken)
+        public override async Task<TScope> CreateAsync([NotNull] OpenIddictScopeDescriptor descriptor, CancellationToken cancellationToken)
         {
-            var scope = new TScope
-            {
-                Name = descriptor.Name
-            };
+            var scope = new TScope();
 
-            return CreateAsync(scope, cancellationToken);
+            await BindAsync(scope, descriptor, cancellationToken);
+            return await CreateAsync(scope, cancellationToken);
         }
 
         /// <summary>
@@ -212,5 +210,32 @@ namespace OpenIddict.EntityFrameworkCore
 
             return Context.SaveChangesAsync(cancellationToken);
         }
+
+        /// <summary>
+        /// Sets the scope properties based on the specified descriptor.
+        /// </summary>
+        /// <param name="scope">The scope to update.</param>
+        /// <param name="descriptor">The scope descriptor.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation.
+        /// </returns>
+        protected virtual Task BindAsync([NotNull] TScope scope, [NotNull] OpenIddictScopeDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            if (scope == null)
+            {
+                throw new ArgumentNullException(nameof(scope));
+            }
+
+            if (descriptor == null)
+            {
+                throw new ArgumentNullException(nameof(descriptor));
+            }
+
+            scope.Description = descriptor.Description;
+            scope.Name = descriptor.Name;
+
+            return Task.CompletedTask;
+        }
     }
 }

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictTokenStore.cs

@@ -148,41 +148,9 @@ namespace OpenIddict.EntityFrameworkCore
                 throw new ArgumentNullException(nameof(descriptor));
             }
 
-            var token = new TToken
-            {
-                Ciphertext = descriptor.Ciphertext,
-                CreationDate = descriptor.CreationDate,
-                ExpirationDate = descriptor.ExpirationDate,
-                Hash = descriptor.Hash,
-                Status = descriptor.Status,
-                Subject = descriptor.Subject,
-                Type = descriptor.Type
-            };
-
-            // Bind the token to the specified client application, if applicable.
-            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
-            {
-                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.ApplicationId) }, cancellationToken);
-                if (application == null)
-                {
-                    throw new InvalidOperationException("The application associated with the token cannot be found.");
-                }
-
-                token.Application = application;
-            }
-
-            // Bind the token to the specified authorization, if applicable.
-            if (!string.IsNullOrEmpty(descriptor.AuthorizationId))
-            {
-                var authorization = await Authorizations.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.AuthorizationId) }, cancellationToken);
-                if (authorization == null)
-                {
-                    throw new InvalidOperationException("The authorization associated with the token cannot be found.");
-                }
-
-                token.Authorization = authorization;
-            }
+            var token = new TToken();
 
+            await BindAsync(token, descriptor, cancellationToken);
             return await CreateAsync(token, cancellationToken);
         }
 
@@ -431,5 +399,59 @@ namespace OpenIddict.EntityFrameworkCore
 
             return Context.SaveChangesAsync(cancellationToken);
         }
+
+        /// <summary>
+        /// Sets the token properties based on the specified descriptor.
+        /// </summary>
+        /// <param name="token">The token to update.</param>
+        /// <param name="descriptor">The token descriptor.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation.
+        /// </returns>
+        protected virtual async Task BindAsync([NotNull] TToken token, [NotNull] OpenIddictTokenDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            if (token == null)
+            {
+                throw new ArgumentNullException(nameof(token));
+            }
+
+            if (descriptor == null)
+            {
+                throw new ArgumentNullException(nameof(descriptor));
+            }
+
+            token.Ciphertext = descriptor.Ciphertext;
+            token.CreationDate = descriptor.CreationDate;
+            token.ExpirationDate = descriptor.ExpirationDate;
+            token.Hash = descriptor.Hash;
+            token.Status = descriptor.Status;
+            token.Subject = descriptor.Subject;
+            token.Type = descriptor.Type;
+
+            // Bind the token to the specified client application, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.ApplicationId))
+            {
+                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.ApplicationId) }, cancellationToken);
+                if (application == null)
+                {
+                    throw new InvalidOperationException("The application associated with the token cannot be found.");
+                }
+
+                token.Application = application;
+            }
+
+            // Bind the token to the specified authorization, if applicable.
+            if (!string.IsNullOrEmpty(descriptor.AuthorizationId))
+            {
+                var authorization = await Authorizations.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.AuthorizationId) }, cancellationToken);
+                if (authorization == null)
+                {
+                    throw new InvalidOperationException("The authorization associated with the token cannot be found.");
+                }
+
+                token.Authorization = authorization;
+            }
+        }
     }
 }

src/OpenIddict/OpenIddictProvider.Helpers.cs

@@ -33,12 +33,18 @@ namespace OpenIddict
         {
             var descriptor = new OpenIddictAuthorizationDescriptor
             {
+                Principal = ticket.Principal,
                 Status = OpenIddictConstants.Statuses.Valid,
                 Subject = ticket.Principal.GetClaim(OpenIdConnectConstants.Claims.Subject),
                 Type = OpenIddictConstants.AuthorizationTypes.AdHoc
             };
 
-            foreach (var scope in request.GetScopes())
+            foreach (var property in ticket.Properties.Items)
+            {
+                descriptor.Properties.Add(property);
+            }
+
+            foreach (var scope in ticket.GetScopes())
             {
                 descriptor.Scopes.Add(scope);
             }
@@ -115,11 +121,17 @@ namespace OpenIddict
                 AuthorizationId = ticket.GetProperty(OpenIddictConstants.Properties.AuthorizationId),
                 CreationDate = ticket.Properties.IssuedUtc,
                 ExpirationDate = ticket.Properties.ExpiresUtc,
+                Principal = ticket.Principal,
                 Status = OpenIddictConstants.Statuses.Valid,
                 Subject = ticket.Principal.GetClaim(OpenIdConnectConstants.Claims.Subject),
                 Type = type
             };
 
+            foreach (var property in ticket.Properties.Items)
+            {
+                descriptor.Properties.Add(property);
+            }
+
             string result = null;
 
             // When reference tokens are enabled or when the token is an authorization code or a