New in IdentityServer4: Multiple allowed Grant Types

In OAuth 2 some grant type combinations are insecure, that’s why we decided for IdentityServer3 that we’ll be defensive and allow only a single grant type per client.

During the last two years of implementing OAuth 2, it turned out that certain combinations of grant types actually do make sense and we adjusted IdentityServer3 to accommodate a couple of those scenarios. But there were still some common cases that either required you to create multiple client configurations for the same logical client – or configuration became a bit messy.

We fixed that in IdentityServer4 – we now allow almost all combinations of grant types for a single client – including the standard ones and extension grants that you add yourself.

We still check that the combination you choose will not result in a security problem – so we haven’t compromised security. Just made the configuration more flexible and easier to use.

See all the details here.

This entry was posted in ASP.NET, IdentityServer, OAuth, OpenID Connect, WebAPI. Bookmark the permalink.

2 Responses to New in IdentityServer4: Multiple allowed Grant Types

  1. Stefano D'Onofrio says:

    Hi Dominick .
    I’m trying to understand the difference beetween IdentityServer3 and IdentityServer4.
    For what I understood the only two difference are the following:
    – IdentityServer4 works with .NET Core and IdentityServer 3 don’t
    – IdentityServer4 allow multiple grant type for one client and IdentityServer3 don’t

    There are other difference?
    There is one reason that I would use IdentityServer4 instead of 3 other than works with .NET Core and have multiple grant type?

    Thank you.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s