title: Issuing Tokens with AspNet.Security.OpenIdConnect.Server (RC2) - Invalid Client?
body: <p>I was able to pull this in RC1. The <code>OpenIdConnectServerProvider</code> has changed quite a bit.</p>
  
  <p>I am interested in the resource owner flow, so my AuthorizationProvider looks like this:</p>
  
  <pre><code>    public sealed class AuthorizationProvider : OpenIdConnectServerProvider
      {
  
          public override Task MatchEndpoint(MatchEndpointContext context)
          {
              if (context.Options.AuthorizationEndpointPath.HasValue &amp;&amp;
                  context.Request.Path.StartsWithSegments(context.Options.AuthorizationEndpointPath))
              {
                  context.MatchesAuthorizationEndpoint();
              }
  
              return Task.FromResult&lt;object&gt;(null);
          }
  
          public override async Task ValidateAuthorizationRequest(ValidateAuthorizationRequestContext context)
          {
              context.Validate();
              await Task.FromResult&lt;object&gt;(null);
          }
  
          public override async Task ValidateTokenRequest(ValidateTokenRequestContext context)
          {                
              if (!context.Request.IsAuthorizationCodeGrantType() &amp;&amp;
                  !context.Request.IsRefreshTokenGrantType() &amp;&amp;
                  !context.Request.IsPasswordGrantType())
              {
                  context.Reject(
                      error: "unsupported_grant_type",
                      description: "Only authorization code, refresh token, and ROPC grant types " +
                                   "are accepted by this authorization server");
              }
  
              /* This is where the problem is. This context.Validate()
                 will automatically return a 400, server_error, with
                 message "An internal server error occurred."
  
                 If I commented this out, I will get a 400, invalid_client.
  
                 If I put in an arbitrary client like "any_client", it
                 goes to GrantResourceOwnerCredentials, as I expect.
                 However, I get a 500 with no explanation when it executes.
                 See the function below for more details.
              */
              context.Validate();
              await Task.FromResult&lt;object&gt;(null);
          }
  
          public override Task HandleUserinfoRequest(HandleUserinfoRequestContext context)
          {                
              context.SkipToNextMiddleware();
  
              return Task.FromResult&lt;object&gt;(null);
          }
  
          public override async Task GrantResourceOwnerCredentials(GrantResourceOwnerCredentialsContext context)
          {
               MYDbContext db = context.HttpContext.RequestServices.GetRequiredService&lt;MyDbContext&gt;();
               UserManager&lt;MyUser&gt; UM = context.HttpContext.RequestServices.GetRequiredService&lt;UserManager&lt;MyUser&gt;&gt;();
  
               MyUser user = await UM.FindByNameAsync(context.Request.Username);
  
               if (user == null)
               {
                  context.Reject(
                     error: "user_not_found",
                     description: "User not found");
  
                  return;
               }
  
               bool passwordsMatch = await UM.CheckPasswordAsync(user, context.Request.Password);
  
               if (!passwordsMatch)
               {
                   context.Reject(
                      error: "invalid_credentials",
                      description: "Password is incorrect");
  
                   return;
               }
  
               var identity = new ClaimsIdentity(OpenIdConnectServerDefaults.AuthenticationScheme);
  
              identity.AddClaim(ClaimTypes.Name, user.UserName, "id_token token");
  
              /* I set the breakpoint on this line, and the execution
                 does not hit this breakpoint. I immediately get a 500.
                 My output says 'System.ArgumentException' in
                 AspNet.Security.OpenIdConnect.Extensions.dll
              */
              List&lt;string&gt; roles = (await UM.GetRolesAsync(user)).ToList();
  
              roles.ForEach(role =&gt;
              {
                  identity.AddClaim(ClaimTypes.Role, role, "id_token token");
              });
  
              var ticket = new AuthenticationTicket(new ClaimsPrincipal(identity),
                                                    new AuthenticationProperties(),
                                                    context.Options.AuthenticationScheme);
  
              ticket.SetResources(new[] { "mlm_resource_server" });
              ticket.SetAudiences(new[] { "mlm_resource_server" });
              ticket.SetScopes(new[] { "defaultscope" });
  
              context.Validate(ticket);
          }
      }
  </code></pre>
  
  <p>By the way, I'm trying to run this on Fiddler:</p>
  
  <pre><code>POST /token HTTP/1.1
  Host: localhost:56785
  Content-Type: application/x-www-form-urlencoded
  
  username=user&amp;password=pw&amp;grant_type=password
  </code></pre>
  
  <p>When the password is incorrect, I get the expected 400 denial, but when the password is correct, I get that 500.</p>
  
  <p>What am I missing? Is the way I build that user identity now incorrect? Am I supposed to override another function?</p>
  
  <p>Note - I didn't provide my startup file because I thought it's irrelevant. I'll post it later if it's absolutely needed.</p>