Register offline_access scope and add refresh_token to the CIMD metadata
document grant_types. Preserve scopes during token exchange so refresh
tokens continue to be issued. Handle stale Identity cookies gracefully
when the database is recreated.
Implement draft-ietf-oauth-client-id-metadata-document-00 support,
allowing OAuth clients to use an HTTPS URL as their client_id with
the server fetching a JSON metadata document from that URL.
- Add EnableClientIdMetadataDocumentSupport option and related config
- Create OpenIddict.Server.SystemNetHttp project for HTTP outbound
metadata document fetching (following Client.SystemNetHttp patterns)
- Modify handler pipeline: ValidateClientId sets CIMD flag when
FindByClientIdAsync returns null and client_id is a valid HTTPS URL
- Add CIMD bypasses to authentication, sign-in, and token generation
handlers that look up pre-registered applications
- Validate redirect_uri against fetched metadata document
- Advertise client_id_metadata_document_supported in discovery
- Update sandbox demonstrator with CIMD support and test endpoint
Minimal ASP.NET Core server for testing CIMD support. Seeds a
pre-registered public client (test-client) and test user, supports
authorization code + PKCE and password grant flows. This serves as
the baseline to verify token issuance before adding CIMD handling.
Thor Arne Johansen