Is it possible to call an equivalent of AddClient in ClientCredentialsTokenManagementBuilder at runtime?

[S-Tasker]

We are in a situation where we wish to use the ClientCredentialsTokenManagementBuilder via AddClientCredentialsTokenManagement in a .Net 8 app.

However, our clients & secrets are configured in an Azure Key Vault.
The Key Vault content is not loaded into the application as a configuration source, but rather by use of a SecretClient, e.g:

//not full code, but gives you the idea
new SecretClient(keyVaultURL, new DefaultAzureCredential())
var secretProperties = secretClient.GetPropertiesOfSecrets();
var tmBuilder = services.AddClientCredentialsTokenManagement();
foreach (var entry in entries)
{
    tmBuilder.AddClient(entry .Name, client =>
    {
        client.TokenEndpoint = configuration.GetRequiredValue<string>("TokenEndpoint");
        client.ClientId = entry.Name;
        client.ClientSecret = secretClient.GetSecret(entry.Name).Value.Value;
    });
}

When we build the application, the SecretClient is setup, grabs the relevant secrets, and adds them to the ClientCredentialsTokenManagementBuilder via AddClient. This is all done during the "build" portion of the application, when IServiceCollection is being built up via WebApplication.CreateBuilder(args).Build().

However, this poses problems for integration tests - we cannot mock out the SecretClient, as we can only reach it during ConfigureServices - which runs after the SecretClient has already been created, and the population of ClientCredentialsTokenManagementBuilder is done.

We would like to refactor this, so that we add clients to be managed at runtime instead - but do not see how that is possible. (we could then easily mock our SecretClient)

Is there a way to leverage the functionality offered here by configuring this library at runtime, rather than during application startup?

[RolandGuijt]

All AddClient does is call Services.Configure to register the client in the ASP.NET options system.
The IConfigureNamedOptions interface in ASP.NET Core can be used to change options outside of app startup.
Would this be a solution for you?

[S-Tasker]

Perhaps i don't understand, but doesn't this assume that i've setup ClientCredentialsClient's to be configurable at Startup?

I'm looking at it now, and if i want to configure these options, i'd do something like:

using Duende.AccessTokenManagement;
using Microsoft.Extensions.Options;

public class ConfigureClientCredentialsClient : IConfigureNamedOptions<ClientCredentialsClient>
{
    public void Configure(ClientCredentialsClient options)
    {
        Configure(Options.DefaultName, options);
    }

    public void Configure(string? name, ClientCredentialsClient options)
    {
        options.TokenEndpoint = "https://example.com/token";
        options.ClientId = "your-client-id";
        options.ClientSecret = "your-client-secret";
        options.Scope = "your-scope";
    }
}

However, if the client given by name does not exist, nothing would be configured.

As it is today, we know we will have some ClientCredentialsClient's, but we don't know how many, nor what they're called. It is therefore not possible to add a dummy to be updated later during application startup.

Do you see any other way around this problem?

[maartenba]

You're on the right track here. You will need to register the named options class in the service container at startup:

builder.Services.AddTransient<IConfigureOptions<ClientCredentialsClient>, ConfigureClientCredentialsClient>();

Next, you can use your class and based on the name parameter, set the desired options:

public class ConfigureClientCredentialsClient : IConfigureNamedOptions<ClientCredentialsClient>
{
    public void Configure(ClientCredentialsClient options)
    {
        Configure(Options.DefaultName, options);
    }

    public void Configure(string? name, ClientCredentialsClient options)
    {
        if (name?.EndsWith("oidc") == true)
        {
            // name: oidc
            options.TokenEndpoint = "https://example.com/token";
            options.ClientId = "your-client-id";
            options.ClientSecret = "your-client-secret";
            options.Scope = "your-scope";
        }
        else if (name?.EndsWith("test") == true)
        {
            // name: test
            options.TokenEndpoint = "https://example.org/token";
            options.ClientId = "client-id";
            options.ClientSecret = "client-secret";
            options.Scope = "scope";
        }
    }
}

This options class can use any source (e.g. a callback in your tests, or any injected data source) to configure the options based on the name.