OpenID Connect server. Generate access token based on 3-rd party token (social login)

I had implemented OpenID Connect server that generates access tokens for mobile client based on username/password using OpenIddict. My next goal was to provide ability to generate Access Token using 3-rd party tokens (social login for example), and I started from integration with Google token, but stuck as cannot find any samples/informations about how to do this.

The only one idea that I currently have is to make request to "/connect/token" endpoint and send Google token in "code" parameter, for example in "google:" format, then override OpenIdConnectServerProvider.DeserializeAuthorizationCode method:

Called when receiving an authorization code. An application may use this context to deserialize the code using a custom format and to skip the default logic using

So I have created own CustomProvider class based on OpenIddictProvider, registered it

services.AddOpenIddict<ApplicationUser, ApplicationRole, ApplicationDbContext, int>()
    .Configure(builder =>
    { builder.Provider = new CustomProvider(sp.GetRequiredService<SignInService>()); }

and overridden the DeserializeAuthorizationCode method:

public override async Task DeserializeAuthorizationCode(DeserializeAuthorizationCodeContext context)
{
    string code = context.Request.Code;
    if (code.StartsWith("google:"))
    {
        string token = code.Replace("google:", "");
        var principal = new GoogleTokenValidator().ValidateToken(token, null).Result;
        var ticket = new AuthenticationTicket(principal, new AuthenticationProperties(), "Bearer");
        ticket.SetPresenters(context.Request.ClientId);
        context.Ticket = ticket;

        context.Ticket.Properties.ExpiresUtc = DateTime.UtcNow.AddDays(1);
        context.HandleResponse();

        await _signInService.Login(principal);

        return; 
    }
    else
    {
        base.DeserializeAuthorizationCode(context);
    }
}

where GoogleTokenValidator is a custom class for Google token handling (it makes call to Google User Information Endpoint and generate ClaimsPrincipal), based on "copy-pasted" code from GoogleHandler class in aspnet/Security repo.

In general it is working with some additional hacks, but I have strong feeling that reinventing the wheel...

Solution

In general it is working with some additional hacks, but I have strong feeling that reinventing the wheel...

You're not only reinventing the wheel, but you're also implementing something totally non-standard that is not supported (at all) by OpenIddict.

Here's the approach I recommend (which is the one we use in the MVC server sample):

The OAuth2/OpenID Connect client application redirects the user agent to your authorization controller (you can take a look at this controller for an example).
OpenIddict will validate the authorization request and allow your controller to be invoked if it's fully valid.
If the user is not already logged in, your authorization controller will redirect the user to the login endpoint, provided by AccountController. At this point, you're free to propose local authentication (e.g using a username/password couple) or Google authentication (you can use the Google authentication middleware for that). You can even offer 2-FA as part of this login process.
Once the user is logged in (e.g after a registration process and/or an external authentication association), his/her browser is redirected back to the authorization endpoint, where a consent form indicating he/she's about to allow your JS app to access his personal data on his/her behalf is displayed.
When the user allows your client application to access his data, the request is handled by your authorization controller, that calls SignInAsync to inform OpenIddict that an authorization code/access token should be returned to your application.