title: Claims for IdentityServer4 user not included in JWT and not sent to Web Api
body: <p>Following the official IdentityServer4 documentation, I reached the point where I have an MVC client app, IdentityServer4 and a Web Api (resource server running). IS4 homepage displays all claims for the user, and when calling the api with the access token, we again get as a result all the user's claims. </p>
  
  <p>Sample code is available <a href="https://github.com/IdentityServer/IdentityServer4.Samples/tree/dev/Quickstarts/6_AspNetIdentity" rel="nofollow noreferrer">here</a>, although it's probably not necessary, and I'm just missing something obvious.</p>
  
  <p>Anyway, for simplicity's sake let's not get claims from the DB and just assign a random hardcoded one:</p>
  
  <pre><code>public class ProfileService : IProfileService
  {
      public Task GetProfileDataAsync(ProfileDataRequestContext context)
      {
          context.IssuedClaims.Add(new System.Security.Claims.Claim("role", "admin"));
          return Task.FromResult(0);
      }
      ...
  }
  </code></pre>
  
  <p>I register the custom Profile service in the startup file and now when I'm logged in on IS4, I see the additional claim.</p>
  
  <p>However, when calling the web api (resource server), this additional claim is not included in the JWT. Code for api call:</p>
  
  <pre><code>    public async Task&lt;IActionResult&gt; CallApiUsingUserAccessToken()
      {
          var accessToken = await HttpContext.Authentication.GetTokenAsync("access_token");
  
          var client = new HttpClient();
          client.SetBearerToken(accessToken);
          var content = await client.GetStringAsync("http://localhost:5001/identity");
  
          ViewBag.Json = JArray.Parse(content).ToString();
          return View("json");
      }
  </code></pre>
  
  <p>(All the api does is return the list of User.Claims). My added claim is not in there, and when I debug the code and pick the access token string and decode it on jwt.io, there's no such claim again.</p>
  
  <p>Question is : what am I missing? is the HttpContext.Authentication.GetTokenAsync bad for my use case, and if so - what is the substitute I'm supposed to use?</p>
  
  <p>Edit: Here are the OpenId Connect Options (on the MVC client):</p>
  
  <pre><code>        app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
          {
              AuthenticationScheme = "oidc",
              SignInScheme = "Cookies",
  
              Authority = "http://localhost:5000",
              RequireHttpsMetadata = false,
  
              ClientId = "mvc",
              ClientSecret = "secret",
  
              ResponseType = "code id_token",
              Scope = { "api1", "offline_access" },
  
              GetClaimsFromUserInfoEndpoint = true,
              SaveTokens = true
          });
  </code></pre>