Update the Discord web provider to support server metadata discovery

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Discovery.cs

@@ -104,8 +104,8 @@ public ValueTask HandleAsync(HandleConfigurationResponseContext context)
 
                 if (context.Registration.ProviderType is
                     ProviderTypes.AlibabaCloud or ProviderTypes.Apple    or
-                    ProviderTypes.FaceIt       or ProviderTypes.LinkedIn or
-                    ProviderTypes.QuickBooksOnline)
+                    ProviderTypes.Discord      or ProviderTypes.FaceIt   or
+                    ProviderTypes.LinkedIn     or ProviderTypes.QuickBooksOnline)
                 {
                     context.Configuration.GrantTypesSupported.Add(GrantTypes.AuthorizationCode);
                     context.Configuration.GrantTypesSupported.Add(GrantTypes.RefreshToken);
@@ -277,7 +277,8 @@ public ValueTask HandleAsync(HandleConfigurationResponseContext context)
                 // configuration and thus are treated as OAuth 2.0-only providers by the OpenIddict client.
                 // To avoid that, the "openid" scope is manually added to indicate OpenID Connect is supported.
                 else if (context.Registration.ProviderType is
-                    ProviderTypes.EpicGames or ProviderTypes.EveOnline or ProviderTypes.Xero)
+                    ProviderTypes.Discord   or ProviderTypes.EpicGames or
+                    ProviderTypes.EveOnline or ProviderTypes.Xero)
                 {
                     context.Configuration.ScopesSupported.Add(Scopes.OpenId);
                 }
@@ -345,6 +346,23 @@ public ValueTask HandleAsync(HandleConfigurationResponseContext context)
                         ClientAuthenticationMethods.ClientSecretPost);
                 }
 
+                // Discord doesn't return the list of supported client authentication methods in its server
+                // configuration but is known to support both "client_secret_basic" and "client_secret_post".
+                else if (context.Registration.ProviderType is ProviderTypes.Discord)
+                {
+                    context.Configuration.TokenEndpointAuthMethodsSupported.Add(
+                        ClientAuthenticationMethods.ClientSecretBasic);
+
+                    context.Configuration.TokenEndpointAuthMethodsSupported.Add(
+                        ClientAuthenticationMethods.ClientSecretPost);
+
+                    context.Configuration.RevocationEndpointAuthMethodsSupported.Add(
+                        ClientAuthenticationMethods.ClientSecretBasic);
+
+                    context.Configuration.RevocationEndpointAuthMethodsSupported.Add(
+                        ClientAuthenticationMethods.ClientSecretPost);
+                }
+
                 // Google doesn't properly implement the device authorization grant, doesn't support
                 // basic client authentication for the device authorization endpoint and returns
                 // a generic "invalid_request" error when using "client_secret_basic" instead of
@@ -435,6 +453,17 @@ public ValueTask HandleAsync(HandleConfigurationResponseContext context)
                         context.Registration.Issuer, new Uri("oidc/logout", UriKind.Relative));
                 }
 
+                // While Discord supports OpenID Connect discovery, the configuration document doesn't include the
+                // address of the revocation endpoint. To work around that, the endpoint URI is manually added here.
+                //
+                // Note: the userinfo endpoint is returned in the configuration document but is replaced here to
+                // use the same endpoint as the one used in previous OpenIddict versions for compatibility reasons.
+                else if (context.Registration.ProviderType is ProviderTypes.Discord)
+                {
+                    context.Configuration.RevocationEndpoint = new Uri("https://discord.com/api/oauth2/token/revoke", UriKind.Absolute);
+                    context.Configuration.UserInfoEndpoint = new Uri("https://discord.com/api/users/@me", UriKind.Absolute);
+                }
+
                 // While Huawei supports OpenID Connect discovery, the configuration
                 // document doesn't return the address of the device authorization endpoint.
                 // To work around that, the endpoint URI is manually added here.

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs

@@ -917,10 +917,10 @@ public ValueTask HandleAsync(ProcessAuthenticationContext context)
             context.DisableBackchannelIdentityTokenNonceValidation = context.Registration.ProviderType switch
             {
                 // These providers don't include the nonce in their identity tokens:
-                ProviderTypes.Asana    or ProviderTypes.DocuSign         or
-                ProviderTypes.Dropbox  or ProviderTypes.FaceIt           or
-                ProviderTypes.LinkedIn or ProviderTypes.QuickBooksOnline or
-                ProviderTypes.WorldId => true,
+                ProviderTypes.Asana    or ProviderTypes.Discord          or
+                ProviderTypes.DocuSign or ProviderTypes.Dropbox          or
+                ProviderTypes.FaceIt   or ProviderTypes.LinkedIn         or
+                ProviderTypes.QuickBooksOnline or ProviderTypes.WorldId => true,
 
                 _ => context.DisableBackchannelIdentityTokenNonceValidation
             };
@@ -1044,6 +1044,10 @@ public ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             context.DisableUserInfoValidation = context.Registration.ProviderType switch
             {
+                // The Discord provider uses a custom API endpoint instead of the standard OpenID
+                // Connect userinfo endpoint for compatibility with previous OpenIddict versions.
+                ProviderTypes.Discord => true,
+
                 // SuperOffice doesn't offer a standard OpenID Connect userinfo endpoint.
                 ProviderTypes.SuperOffice => true,
 

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml

@@ -714,16 +714,6 @@
   <Provider Name="Discord" Id="542ac9f1-514f-4b8a-bc4c-d56d2b8356e5"
             Documentation="https://discord.com/developers/docs/topics/oauth2">
     <Environment Issuer="https://discord.com/">
-      <Configuration AuthorizationEndpoint="https://discord.com/oauth2/authorize"
-                     RevocationEndpoint="https://discord.com/api/oauth2/token/revoke"
-                     TokenEndpoint="https://discord.com/api/oauth2/token"
-                     UserInfoEndpoint="https://discord.com/api/users/@me">
-        <CodeChallengeMethod Value="S256" />
-
-        <GrantType Value="authorization_code" />
-        <GrantType Value="refresh_token" />
-      </Configuration>
-
       <!--
         Note: Discord requires sending the "identify" scope to be able to use the userinfo endpoint.
       -->