Latest version not working with CustomFlow

[Gillardo]

Not sure which version i was using before, 2.0.0-* but custom flows were working fine. Now i have updated and my custom flows are broken.

I am getting an error saying

This client application is not allowed to use the token endpoint.

Any idea why i am getting this??

[Gillardo]

I deleted all my openIddict tables, and wipes the initialCreate so all has setup fresh... Using the following code

// Create a new service scope to ensure the database context is correctly disposed when this methods returns.
using (var scope = app.ApplicationServices.GetRequiredService<IServiceScopeFactory>().CreateScope())
{
	// setup application
	var applicationDbContext = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
	applicationDbContext.Database.Initialize(false);

	var manager = scope.ServiceProvider.GetRequiredService<OpenIddictApplicationManager<OpenIddictApplication>>();

	if (await manager.FindByClientIdAsync("api", cancellationToken) == null)
	{
		logger.LogInformation("Application missing in database, adding now...");

		var descriptor = new OpenIddictApplicationDescriptor
		{
			ClientId = "api",
			DisplayName = "m2iActiv Api",
			RedirectUris = { new Uri("http://www.my-url.com/signin-oidc") },
			PostLogoutRedirectUris = { new Uri("http://www.my-url.com/") }
		};

		await manager.CreateAsync(descriptor, cancellationToken);
	}
}

... save later

noticed there are a properties and permissions column now in openiddictapplications table, but they are blank??

[kevinchalet]

Applications must now be granted permissions to use the OAuth2/OIDC endpoints/flows.

The migration guide I wrote includes a script that adds all the permissions to existing applications. Since you didn't follow it, your Permissions column is empty.

Simply add the permissions you need and it will work. E.g:

var descriptor = new OpenIddictApplicationDescriptor
{
    ClientId = "api",
    DisplayName = "m2iActiv Api",
    RedirectUris = { new Uri("http://www.my-url.com/signin-oidc") },
    PostLogoutRedirectUris = { new Uri("http://www.my-url.com/") },
    Permissions =
    {
        OpenIddictConstants.Permissions.Endpoints.Token,
        OpenIddictConstants.Permissions.GrantTypes.Password,
        OpenIddictConstants.Permissions.GrantTypes.RefreshToken,
        OpenIddictConstants.Permissions.Prefixes.GrantType + "your custom grant type name",
    }
};

[kevinchalet]

For the record, the application permissions feature is now optional. It's documented here: https://openiddict.github.io/openiddict-documentation/features/application-permissions.html