Abort authentication demands with an explicit grant type if it's not listed as supported in the server configuration

src/OpenIddict.Abstractions/OpenIddictResources.resx

@@ -1381,6 +1381,9 @@ Consider registering a certificate using 'services.AddOpenIddict().AddClient().A
   <data name="ID0362" xml:space="preserve">
     <value>No response mode enabled in the client options could be found in the list of response modes allowed by the client registration, which typically indicates an invalid configuration. Ensure the 'OpenIddictClientRegistration.ResponseModes' collection contain at least one of the response modes enabled in the client options or leave it empty to allow OpenIddict to negotiate all the enabled response modes.</value>
   </data>
+  <data name="ID0363" xml:space="preserve">
+    <value>The specified grant type ({0}) is not listed as a supported grant type in the server configuration. If the error persists, ensure the supported grant types listed in the authorization server configuration are appropriate.</value>
+  </data>
   <data name="ID2000" xml:space="preserve">
     <value>The security token is missing.</value>
   </data>

src/OpenIddict.Client.SystemNetHttp/OpenIddictClientSystemNetHttpHandlers.cs

@@ -7,7 +7,6 @@
 using System.Collections.Immutable;
 using System.ComponentModel;
 using System.Diagnostics;
-using System.Diagnostics.CodeAnalysis;
 using System.IO.Compression;
 using System.Net.Http.Headers;
 using Microsoft.Extensions.Logging;
@@ -125,7 +124,7 @@ public static partial class OpenIddictClientSystemNetHttpHandlers
             request.Headers.AcceptCharset.Add(new StringWithQualityHeaderValue(Charsets.Utf8));
 
             // Note: for security reasons, HTTP compression is never opted-in by default. Providers
-            // that require using HTTP compression that register a custom event handler to send an
+            // that require using HTTP compression can register a custom event handler to send an
             // Accept-Encoding header containing the supported algorithms (e.g GZip/Deflate/Brotli).
 
             return default;

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Discovery.cs

@@ -19,7 +19,8 @@ public static partial class OpenIddictClientWebIntegrationHandlers
              * Configuration response handling:
              */
             AmendIssuer.Descriptor,
-            AmendClientAuthenticationMethods.Descriptor,
+            AmendGrantTypes.Descriptor,
+            AmendTokenEndpointClientAuthenticationMethods.Descriptor,
             AmendCodeChallengeMethods.Descriptor,
             AmendEndpoints.Descriptor);
 
@@ -64,17 +65,62 @@ public static partial class OpenIddictClientWebIntegrationHandlers
         }
 
         /// <summary>
-        /// Contains the logic responsible for amending the supported
-        /// client authentication methods for the providers that require it.
+        /// Contains the logic responsible for amending the supported grant types for the providers that require it.
+        /// </summary>
+        public sealed class AmendGrantTypes : IOpenIddictClientHandler<HandleConfigurationResponseContext>
+        {
+            /// <summary>
+            /// Gets the default descriptor definition assigned to this handler.
+            /// </summary>
+            public static OpenIddictClientHandlerDescriptor Descriptor { get; }
+                = OpenIddictClientHandlerDescriptor.CreateBuilder<HandleConfigurationResponseContext>()
+                    .UseSingletonHandler<AmendGrantTypes>()
+                    .SetOrder(ExtractGrantTypes.Descriptor.Order + 500)
+                    .SetType(OpenIddictClientHandlerType.BuiltIn)
+                    .Build();
+
+            /// <inheritdoc/>
+            public ValueTask HandleAsync(HandleConfigurationResponseContext context)
+            {
+                if (context is null)
+                {
+                    throw new ArgumentNullException(nameof(context));
+                }
+
+                // Note: some providers don't list the grant types they support, which prevents the OpenIddict
+                // client from using them (unless they are assumed to be enabled by default, like the
+                // authorization code or implicit flows). To work around that, the list of supported grant
+                // types is amended to include the known supported types for the providers that require it.
+
+                if (context.Registration.ProviderName is Providers.Apple)
+                {
+                    context.Configuration.GrantTypesSupported.Add(GrantTypes.AuthorizationCode);
+                    context.Configuration.GrantTypesSupported.Add(GrantTypes.RefreshToken);
+                }
+
+                else if (context.Registration.ProviderName is Providers.Cognito or Providers.Microsoft)
+                {
+                    context.Configuration.GrantTypesSupported.Add(GrantTypes.AuthorizationCode);
+                    context.Configuration.GrantTypesSupported.Add(GrantTypes.ClientCredentials);
+                    context.Configuration.GrantTypesSupported.Add(GrantTypes.RefreshToken);
+                }
+
+                return default;
+            }
+        }
+
+        /// <summary>
+        /// Contains the logic responsible for amending the client authentication
+        /// methods supported by the token endpoint for the providers that require it.
         /// </summary>
-        public sealed class AmendClientAuthenticationMethods : IOpenIddictClientHandler<HandleConfigurationResponseContext>
+        public sealed class AmendTokenEndpointClientAuthenticationMethods : IOpenIddictClientHandler<HandleConfigurationResponseContext>
         {
             /// <summary>
             /// Gets the default descriptor definition assigned to this handler.
             /// </summary>
             public static OpenIddictClientHandlerDescriptor Descriptor { get; }
                 = OpenIddictClientHandlerDescriptor.CreateBuilder<HandleConfigurationResponseContext>()
-                    .UseSingletonHandler<AmendClientAuthenticationMethods>()
+                    .UseSingletonHandler<AmendTokenEndpointClientAuthenticationMethods>()
                     .SetOrder(ExtractTokenEndpointClientAuthenticationMethods.Descriptor.Order + 500)
                     .SetType(OpenIddictClientHandlerType.BuiltIn)
                     .Build();

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml

@@ -15,10 +15,12 @@
 
   <Provider Name="Cognito" Documentation="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-reference.html">
     <Environment Issuer="https://cognito-idp.{region}.amazonaws.com/{userPoolId}" />
+
     <Setting PropertyName="Region" ParameterName="region" Type="String" Required="true"
-           Description="The AWS region" />
+             Description="The AWS region" />
+
     <Setting PropertyName="UserPoolId" ParameterName="identifier" Type="String" Required="true"
-           Description="The User Pool ID" />
+             Description="The User Pool ID" />
   </Provider>
  
   <Provider Name="Deezer" Documentation="https://developers.deezer.com/api/oauth">

src/OpenIddict.Client/OpenIddictClientHandlers.cs

@@ -284,6 +284,13 @@ public static partial class OpenIddictClientHandlers
             {
                 throw new InvalidOperationException(SR.GetResourceString(SR.ID0307));
             }
+
+            // Ensure the selected grant type, if explicitly set, is listed as supported in the configuration.
+            if (!string.IsNullOrEmpty(context.GrantType) &&
+                !context.Configuration.GrantTypesSupported.Contains(context.GrantType))
+            {
+                throw new InvalidOperationException(SR.FormatID0363(context.GrantType));
+            }
         }
     }
 

src/OpenIddict.Validation.SystemNetHttp/OpenIddictValidationSystemNetHttpHandlers.cs

@@ -7,7 +7,6 @@
 using System.Collections.Immutable;
 using System.ComponentModel;
 using System.Diagnostics;
-using System.Diagnostics.CodeAnalysis;
 using System.IO.Compression;
 using System.Net.Http.Headers;
 using Microsoft.Extensions.Logging;
@@ -124,7 +123,7 @@ public static partial class OpenIddictValidationSystemNetHttpHandlers
             request.Headers.AcceptCharset.Add(new StringWithQualityHeaderValue(Charsets.Utf8));
 
             // Note: for security reasons, HTTP compression is never opted-in by default. Providers
-            // that require using HTTP compression that register a custom event handler to send an
+            // that require using HTTP compression can register a custom event handler to send an
             // Accept-Encoding header containing the supported algorithms (e.g GZip/Deflate/Brotli).
 
             return default;