c# - Getting claims in identity server using resource owner password -

i using identity server 4 authentication using grant type 'resourceownerpassword'. able authenticate user not able claims related user. how can ?

below code

client

startup.cs

app.useidentityserverauthentication(new identityserverauthenticationoptions             {                 authority = "http://localhost:5000",                 requirehttpsmetadata = false,                 apiname = "api1"             }); 

controller

public async task<iactionresult> authentication(loginviewmodel model)         {             var disco = await discoveryclient.getasync("http://localhost:5000");              // request token             var tokenclient = new tokenclient(disco.tokenendpoint, "ro.client", "secret");             var tokenresponse = await tokenclient.requestresourceownerpasswordasync(model.email, model.password, "api1");              if (tokenresponse.iserror)             {                 console.writeline(tokenresponse.error);             } // here not getting claims, coming forbidden             var extraclaims = new userinfoclient(disco.userinfoendpoint);             var identityclaims = await extraclaims.getasync(tokenresponse.accesstoken);             if (!tokenresponse.iserror)             {                 console.writeline(identityclaims.json);             }              console.writeline(tokenresponse.json);             console.writeline("\n\n"); } 

server startup.cs

services.addidentityserver()                 .addtemporarysigningcredential()                 .addinmemorypersistedgrants()                 .addinmemoryidentityresources(config.getidentityresources())                 .addinmemoryapiresources(config.getapiresources())                 .addinmemoryclients(config.getclients(configuration))                 .addaspnetidentity<applicationuser>()                 .addprofileservice<identityprofileservice>()                 .addresourceownervalidator<resourceownerpasswordvalidator>(); 

config.cs

 public static ienumerable<client> getclients(iconfigurationroot configuration)         {             // client credentials client             return new list<client>             {                  // resource owner password grant client                 new client                 {                     clientid = "ro.client",                     allowedgranttypes = granttypes.resourceownerpassword,                      clientsecrets =                     {                         new secret("secret".sha256())                     },                     alwayssendclientclaims = true,                     alwaysincludeuserclaimsinidtoken = true,                       accesstokentype = accesstokentype.jwt                  }              };         }  public static ienumerable<apiresource> getapiresources()         {             return new list<apiresource>             {                 new apiresource("api1", "my api")             };         } 

but when check access token in jwt.io there can see claims why not able in controller ?

any on appreciated !

you can call userinfoendpoint, per example, can additional claims if define apiresource requiring them.

for example, rather defining apiresource are:

new apiresource("api1", "my api") 

you can use expanded format , define userclaims you'd have when getting access token scope. example:

new apiresource {     name = "api1",     apisecrets = { new secret(*some secret*) },     userclaims = {         jwtclaimtypes.email,         jwtclaimtypes.phonenumber,         jwtclaimtypes.givenname,         jwtclaimtypes.familyname,         jwtclaimtypes.preferredusername     },     description = "my api",     displayname = "myapi1",     enabled = true,     scopes = { new scope("api1") } } 

then in own implementation of iprofileservice find calls getprofiledataasync have list of claims requested in context (profiledatarequestcontext.requestedclaimtypes). given list of what's been asked for, can add claims - - context.issuedclaims return method. these part of access token.

if want claims calling userinfo endpoint though, you'll want create identityresource definition , have scope included part of original token request. example:

new identityresource {     name = "myidentityscope",     userclaims = {         jwtclaimtypes.emailverified,         jwtclaimtypes.phonenumberverified     } } 

but first problem following other answer here don't 'forbidden' response userinfo endpoint!