OpenIddict与OIDC客户端认证中Response Type无效及混合流不支持问题求助

Let's break down your two problems and walk through how to resolve them step by step:

1. "Open ID connect hybrid flow is not supported" Error #

This error happens because your server-side OpenIddict client registration hasn't been configured to allow the hybrid flow. Here's what you need to adjust:

• On the server, when registering your client with OpenIddict, explicitly enable the hybrid flow by adding GrantTypes.Hybrid to AllowedGrantTypes, and include ResponseTypes.CodeIdToken in AllowedResponseTypes (since your client is using CodeIdToken as the response type).

Example server-side client registration code:

await manager.CreateAsync(new OpenIddictApplicationDescriptor
{
    ClientId = AuthenticationClient.WebClientId,
    RedirectUris = { new Uri("https://your-client-domain/authentication/login-callback") },
    PostLogoutRedirectUris = { new Uri(baseUrl) },
    AllowedGrantTypes = GrantTypes.AuthorizationCode | GrantTypes.Hybrid,
    AllowedResponseTypes = ResponseTypes.Code | ResponseTypes.CodeIdToken,
    AllowedScopes = { Scopes.OpenId, Scopes.Profile, AuthenticationClient.WebClientApiScope },
    RequirePkce = true,
    // Set to false if this is a public client (like SPA/desktop app)
    RequireClientSecret = false
});

Hybrid flow isn't enabled by default in OpenIddict, so explicit configuration on the server is mandatory.

2. "unauthorized_client" Error with response_type="code" #

This error indicates your client isn't authorized to use the authorization code flow. To fix this:

1. Server-side adjustment: Update your OpenIddict client registration to include GrantTypes.AuthorizationCode in AllowedGrantTypes (if it's missing).
2. Client-side adjustment: Ensure your AddOpenIdConnect configuration uses the correct response type for authorization code flow:

   options.ResponseType = OpenIdConnectResponseType.Code;
   

The ID2043 error you're seeing directly relates to the client not having permission to use the requested flow—double-check that AllowedGrantTypes on the server explicitly includes AuthorizationCode.

Quick Additional Checks #

• Confirm your client's CallbackPath matches exactly with the RedirectUris configured on the server (case sensitivity matters!).
• For public clients (like Blazor WASM or desktop apps), set RequireClientSecret = false in the server-side registration.
• Keep RequireHttpsMetadata = true for production environments (your current code already has this set correctly).

内容的提问来源于stack exchange，提问作者Msr Devadiga