title: Identity Server: Add claims to access token in hybrid flow in MVC client
body: <p>I've read the docs and followed the examples but I am unable to get user claims into the access token. My client is not ASP.NET core, so the configuration of the MVC client is not the same as the v4 samples. </p>
  
  <p>Unless I have misunderstood the docs, the ApiResources are used to populate the RequestedClaimTypes in the profile service when creating the access token. The client should add the api resource to it's list of scopes to include associated userclaims. In my case they are not being connected.</p>
  
  <p>When ProfileService.GetProfileDataAsync is called with a caller of "ClaimsProviderAccessToken", the requested claim types are empty. Even if I set the context.IssuedClaims in here, when it is called again for "AccessTokenValidation" the claims on the context are not set.</p>
  
  <p>In the MVC app:</p>
  
  <pre><code>    app.UseOpenIdConnectAuthentication(
              new OpenIdConnectAuthenticationOptions
              {
                  UseTokenLifetime = false, 
                  ClientId = "portal",
                  ClientSecret = "secret",
                  Authority = authority,
                  RequireHttpsMetadata = false,
                  RedirectUri = redirectUri,
                  PostLogoutRedirectUri = postLogoutRedirectUri,
                  ResponseType = "code id_token",
                  Scope = "openid offline_access portal",
                  SignInAsAuthenticationType = "Cookies",
                  Notifications = new OpenIdConnectAuthenticationNotifications
                  {
                      AuthorizationCodeReceived = async n =&gt;
                      {
                          await AssembleUserClaims(n);
                      },
                      RedirectToIdentityProvider = n =&gt;
                      {
                          // if signing out, add the id_token_hint
                          if (n.ProtocolMessage.RequestType == Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectRequestType.Logout)
                          {
                              var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token");
  
                              if (idTokenHint != null)
                              {
                                  n.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                              }
  
                          }
  
                          return Task.FromResult(0);
                      }
                  }
              });
  
      private static async Task AssembleUserClaims(AuthorizationCodeReceivedNotification notification)
      {
  
          string authCode = notification.ProtocolMessage.Code;
  
          string redirectUri = "https://myuri.com";
  
          var tokenClient = new TokenClient(tokenendpoint, "portal", "secret");
  
          var tokenResponse = await tokenClient.RequestAuthorizationCodeAsync(authCode, redirectUri);
  
          if (tokenResponse.IsError)
          {
              throw new Exception(tokenResponse.Error);
          }
  
          // use the access token to retrieve claims from userinfo
          var userInfoClient = new UserInfoClient(new Uri(userinfoendpoint), tokenResponse.AccessToken);
  
          var userInfoResponse = await userInfoClient.GetAsync();
  
          // create new identity
          var id = new ClaimsIdentity(notification.AuthenticationTicket.Identity.AuthenticationType);
          id.AddClaims(userInfoResponse.GetClaimsIdentity().Claims);
          id.AddClaim(new Claim("access_token", tokenResponse.AccessToken));
          id.AddClaim(new Claim("expires_at", DateTime.Now.AddSeconds(tokenResponse.ExpiresIn).ToLocalTime().ToString()));
          id.AddClaim(new Claim("refresh_token", tokenResponse.RefreshToken));
          id.AddClaim(new Claim("id_token", notification.ProtocolMessage.IdToken));
          id.AddClaim(new Claim("sid", notification.AuthenticationTicket.Identity.FindFirst("sid").Value));
          notification.AuthenticationTicket = new AuthenticationTicket(id, notification.AuthenticationTicket.Properties);
      }
  </code></pre>
  
  <p>Identity Server Client:</p>
  
  <pre><code>    private Client CreatePortalClient(Guid tenantId)
      {
          Client portal = new Client();
          portal.ClientName = "Portal MVC";
          portal.ClientId = "portal";
          portal.ClientSecrets = new List&lt;Secret&gt; { new Secret("secret".Sha256()) };
          portal.AllowedGrantTypes = GrantTypes.HybridAndClientCredentials;
          portal.RequireConsent = false; 
          portal.RedirectUris = new List&lt;string&gt; {
              "https://myuri.com",
          };
          portal.AllowedScopes = new List&lt;string&gt;
          {
                  IdentityServerConstants.StandardScopes.OpenId,
                  IdentityServerConstants.StandardScopes.Profile,
                  "portal"
          };
          portal.Enabled = true;
          portal.AllowOfflineAccess = true;
          portal.AlwaysSendClientClaims = true;
          portal.AllowAccessTokensViaBrowser = true;
  
          return portal;
      }
  </code></pre>
  
  <p>The API resource:</p>
  
  <pre><code>public static IEnumerable&lt;ApiResource&gt; GetApiResources()
      {
          return new List&lt;ApiResource&gt;
          {
              new ApiResource
              {
                  Name= "portalresource",
                  UserClaims = { "tenantId","userId","user" }, 
                  Scopes =
                  {
                      new Scope()
                      {
                          Name = "portalscope",
                          UserClaims = { "tenantId","userId","user",ClaimTypes.Role, ClaimTypes.Name),
  
                      },
  
                  }
              },
  
          };
      }
  </code></pre>
  
  <p>The Identity resource:</p>
  
  <pre><code>    public static IEnumerable&lt;IdentityResource&gt; GetIdentityResources()
      {
          return new IdentityResource[]
          {
              // some standard scopes from the OIDC spec
              new IdentityResources.OpenId(),
              new IdentityResources.Profile(),
              new IdentityResources.Email(),
              new IdentityResource("portal", new List&lt;string&gt;{ "tenantId", "userId", "user", "role", "name"})
          };
      }
  </code></pre>
  
  <p>UPDATE:</p>
  
  <p>Here is the interaction between the MVC app and the Identity Server (IS):</p>
  
  <pre><code>MVC: 
      Owin Authentication Challenge
  IS:
      AccountController.LoginAsync - assemble user claims and call HttpContext.SignInAsync with username and claims)
      ProfileService.IsActiveAsync - Context = "AuthorizeEndpoint", context.Subject.Claims = all userclaims
      ClaimsService.GetIdentityTokenClaimsAsync - Subject.Claims (all userclaims), resources = 1 IdentityResource (OpenId), GrantType = Hybrid
  MVC:
      SecurityTokenValidated (Notification Callback)
      AuthorizationCodeReceived - Protocol.Message has Code and IdToken call to TokenClient.RequestAuthorizationCodeAsync()
  IS: 
      ProfileService.IsActiveAsync - Context = "AuthorizationCodeValidation", context.Subject.Claims = all userclaims
      ClaimsService.GetAccessTokenClaimsAsync - Subject.Claims (all userclaims), resources = 2 IdentityResource (openId,profile), GrantType = Hybrid
      ProfileService.GetProfileDataAsync - Context = "ClaimsProviderAccessToken", context.Subject.Claims = all userclaims, context.RequestedClaimTypes = empty, context.IssuedClaims = name,role,user,userid,tenantid
      ClaimsService.GetIdentityTokenClaimsAsync - Subject.Claims (all userclaims), resources = 2 IdentityResource (openId,profile), GrantType = authorization_code
  
  MVC:
      call to UserInfoClient with tokenResponse.AccessToken
  IS:
      ProfileService.IsActiveAsync - Context = "AccessTokenValidation", context.Subject.Claims = sub,client_id,aud,scope etc (expecting user and tenantId here)
      ProfileService.IsActiveAsync - Context = "UserInfoRequestValidation", context.Subject.Claims = sub,auth_time,idp, amr
      ProfileService.GetProfileDataAsync - Context = "UserInfoEndpoint", context.Subject.Claims = sub,auth_time,idp,amp, context.RequestedClaimTypes = sub
  </code></pre>