What are the valid grant_type values for IdentityServer4 with a Client using Hybrid grant type?

Question

Im using version version 1.0.0 of the IdentityServer4 package.

"IdentityServer4": "1.0.0"

I've created a Client

new Client
{
    ClientId = "MobleAPP",
    ClientName = "Moble App",
    ClientUri= "http://localhost:52997/api/",                    
    AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,

    ClientSecrets =
    {
        new Secret("SecretForMobleAPP".Sha256())
    },

    AllowedScopes =
    {
        IdentityServerConstants.StandardScopes.OpenId,
        IdentityServerConstants.StandardScopes.Profile,
        "api"
    },
    AllowOfflineAccess = true
}

And the scope/ApiResources

public static IEnumerable<ApiResource> GetApiResources()
{
   return new List<ApiResource>
   {

      new ApiResource("api", "My API")

    };
}

With the following user/TestUser

public static List<TestUser> GetUsers()
{
        return new List<TestUser>
        {

            new TestUser
            {
                SubjectId = "2",
                Username = "bob",
                Password = "password",

                Claims = new []
                {
                    new Claim(JwtClaimTypes.Name, "Bob Smith")
                }
            }
        };
}

I'm trying to test the IdentityServer that I have setup from Postman and determine the possible values for the grant_type key value pair.

I can successfully connect when I set the grant_type to client_credentials and wasn't sure if there were other options for the grant_type value.

Working Postman configuration with grant_type set to client_credentials

Answer 1

Short answer

client_credentials is the only grant_type value you can use directly against the token endpoint when using both hybrid and client credentials grant types.

---

Longer answer

The client credentials grant type is the only one allowing you to hit the token endpoint directly, which is what you did in your Postman example. In that case the authentication is done against the client itself - i.e. the application you registered.

When you use the hybrid grant type, the authentication will be done against the end-user - the user using your application. In that case, you cannot hit the endpoint token directly but you'll have to issue an authorization request to IdentityServer.

When you do so, you won't use the grant_type parameter but the response_type parameter, to instruct IdentityServer what you expect back. The possible values for response_type when you use the hybrid grant type can be found in IdentityServer constants - they are the last 3 items in the dictionary:

• code id_token, which will return an authorization code and an identity token
• code token, returning an authorization code and an access token
• code id_token token, giving you back an authorization code, an identity token and an access token

After you get the authorization code, you'll be able to exchange it for an access token and possibily a refresh token by hitting the token endpoint.