ClientCredentialsClient IOptions Change Propagation Issue

[tleblanc159]

Which version of Duende IdentityServer are you using?
1.0.0

Which version of .NET are you using?
.NET 6

Describe the bug
When configuring the ClientCredentialsClient in ConfigureServices using services.Configure<ClientCredentialsClient>("client-name", _configuration.GetSection("config-section")), changes made in the configuration are not respected by the named ClientCredentialsClient IOptions instance. For instance, after locally updating a value in appsettings.json, I can see the updated value reflected in the IConfiguration instance, but this updated value is not propagated to the IOptions instance.

This IOptions instance is injected into the ClientCredentialsTokenEndpointService using the IOptionsSnapshot interface. The ClientCredentialsTokenEndpointService service has a Transient lifetime (added to the container using services.AddClientCredentialsTokenManagement()). The instance of the IOptionsSnapshot injected should have a Scoped lifetime; meaning that each new request should regenerate a given named IOptions instance, retrieving any updated values from the configuration provider. Regardless, the cached value of the IOptions instance is never updated.

The IOptions instance lifetime is as expected when injecting it using the IOptionsSnapshot interface in an MVC controller, i.e. an new given IOptions named instance is created, pulling config provider values, on every request.

The ClientCredentialsTokenHandler is added to my HttpClient using the AddClientCredentialsTokenHandler extension method, e.g:

services.AddHttpClient<SvcClient>(SvcClient.ConfigureClient)
        .ConfigurePrimaryHttpMessageHandler(GetDefaultSocketsHttpHandler)
        .AddClientCredentialsTokenHandler("client-name");

To Reproduce

public void ConfigureServices(IServiceCollection services)
{
    services.AddClientCredentialsTokenManagement();
    
    services.Configure<ClientCredentialsClient>("client-name", _configuration.GetSection("config:section"));
    
    services.AddHttpClient<SvcClient>(SvcClient.ConfigureClient)
            .ConfigurePrimaryHttpMessageHandler(GetDefaultSocketsHttpHandler)
            .AddClientCredentialsTokenHandler("client-name");
}

private SocketsHttpHandler GetDefaultSocketsHttpHandler()
{
    return new()
    {
        AllowAutoRedirect = true,
        EnableMultipleHttp2Connections = true,
        MaxConnectionsPerServer = int.MaxValue,
        MaxResponseHeadersLength = int.MaxValue,
        PooledConnectionLifetime = TimeSpan.FromMinutes(1)
    };
}

After making a successful HttpClient call (i.e. OAuth token was retrieved successfully), change configuration value that the ClientCredentialsClient IOptions is bound to. This can be achieved by changing appsettings.json values locally.

Expected behavior

IOptionsSnapshot instance receives updated configuration values.

Log output/exception with stacktrace
N/A

Additional context

I fixed this issue simply by changing the IOptions interface injected into ClientCredentialsTokenEndpointService from IOptionsSnapshot to IOptionsMonitor (ref: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/configuration/options?view=aspnetcore-6.0#options-interfaces).

However, IOptionsSnapshot should work as intended here.

Changing:

public ClientCredentialsTokenEndpointService(
        IHttpClientFactory httpClientFactory,
        IOptionsSnapshot<ClientCredentialsClient> options,
        ...

to

public ClientCredentialsTokenEndpointService(
        IHttpClientFactory httpClientFactory,
        IOptionsMonitor<ClientCredentialsClient> options,
        ...

[tleblanc159]

@damianh @brockallen @josephdecock @leastprivilege

Is this the right place for this issue? I wasn't given an option to report an issue with Duende.AccessTokenManagement, so I went with IdentityServer.

[leastprivilege]

Thanks! We will look into it.

[leastprivilege]

Maybe related to #516

[leastprivilege]

pushing v1.1 right now