Thinktecture "insufficient_scope" error. Singular scope claim versus list of scopes

Question

I'm sure the answer is obvious, but it's eluding me at the moment.

I get a 403 when my code tries to call /connect/userinfo and the message is "insufficient_scope".

https://github.com/IdentityServer/IdentityServer3/blob/master/source/Core/Validation/TokenValidator.cs#L153

Above is the line of code that checks for the scope claim in a JWT and wants to find the value to be "openid" to make the /connect/userinfo endpoint work.

In my JWT, if it has something like:

"scope": "openid"

... then the endpoint is fine. Instead if I have:

"scope": ["openid", "email", "profile"]

... then it fails.

Am I supposed to never have a list/array of scope claims? Maybe I'm missing a configuration setting somewhere?

Update with code

Sorry. Of course code will make the problem clearer.

Client Store

    public ClientStore()
    {
        _clients = new List<Client>
        {
            new Client
            {
                AlwaysSendClientClaims = true,
                RequireConsent = false,
                Enabled = true,
                ClientName = @"MVC Client",
                ClientId = @"mvc",
                PostLogoutRedirectUris = new List<string>
                {
                    "http://localhost:8080/index.html"
                },
                RedirectUris = new List<string>
                {
                    "http://localhost:8080/loginCallback.html"
                }
            }
        };
    }

Scope store

    public ScopeStore()
    {
        var scopes = new List<Scope>
        {
            StandardScopes.OpenId,
            StandardScopes.Profile,
            StandardScopes.Email,
            StandardScopes.Address,
            StandardScopes.AllClaims,
            StandardScopes.RolesAlwaysInclude
        };

        _scopes = scopes;
    }

Startup.cs

        var certFile = env.ApplicationBasePath + "/cert.pfx";

        app.Map("/core", core =>
        {
            var factory = new IdentityServerServiceFactory();

            var configuration = new Configuration();
            configuration.AddJsonFile("config.json");

            var userService = new EndUserService(configuration.Get("ConnectionString"));
            factory.UserService = new Registration<IUserService>(resolver => userService);

            var scopeStore = new ScopeStore();
            factory.ScopeStore = new Registration<IScopeStore>(resolver => scopeStore);

            var clientStore = new ClientStore();
            factory.ClientStore = new Registration<IClientStore>(resolver => clientStore); 

            var cert = new X509Certificate2(certFile, "test");

            var idsrvOptions = new IdentityServerOptions
            {
                CorsPolicy = CorsPolicy.AllowAll,
                Factory = factory,
                RequireSsl = false,
                SigningCertificate = cert,
                LoggingOptions = new LoggingOptions() {
                    EnableWebApiDiagnostics = true,
                    EnableHttpLogging = true
                }
            };

            core.UseIdentityServer(idsrvOptions);
        });

Login.html

var config = {
    client_id: "mvc",
    redirect_uri: "http://localhost:8080/loginCallback.html",
    response_type: "id_token token",
    scope: "openid email profile",
    authority: "http://localhost:44319/core",
    post_logout_redirect_uri: "http://localhost:8080/index.html"
};
var mgr = new OidcTokenManager(config);

UPDATE #2

Shoot, it's a Mono versus Windows thing. Works fine in Windows, broken in Mono. Known issue apparently: https://github.com/IdentityServer/IdentityServer3/issues/1373#issuecomment-104756822

Answer 1

Turns out there is a bug with how Microsoft's JWT library interprets JWT claims. Described here: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/153

Waiting for that pull request to be accepted or for the problem to be fixed in some other manner.