IdentityServer AspNetIdentity AspNetUserClaims not populating on Client

Question

I'm using IdentityServer3 with IdentityServer3.AspNetIdentity using an OpenId client I can successfully authenticate, however the claims held in the AspNetUserClaims table are not being sent to the client. IdentityServer is configured as:

1. Hybrid Flow
2. Always Send Client Claims is true
3. Scopes: openid profile email

I added a custom class based on AspNetIdentityUserService and override the GetClaimsFromAccount method. I provided the same implementation as the original (https://github.com/IdentityServer/IdentityServer3.AspNetIdentity/blob/master/source/IdentityServer3.AspNetIdentity/IdentityServer3.AspNetIdentity.cs) and set a breakpoint - I can see all of the claims held in AspNetUserClaims, however they are not included in the Claims collection on the client.

My client code is:

OpenIdConnectAuthenticationOptions openIdConnectAuthenticationOptions = new OpenIdConnectAuthenticationOptions
            {
                //BackchannelTimeout = TimeSpan.FromMinutes(sessionTimeoutInMinutes),
                ClientId = "xxx",
                Authority = "https://xxx/core",
                PostLogoutRedirectUri = "https://localhost:44304",
                ResponseType = "code id_token token",
                Scope = "openid profile email",
                Notifications = new OpenIdConnectAuthenticationNotifications()
                {
                    SecurityTokenValidated =  async (context) =>
                    {
                        //string userId = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.Name).Value;
                        var id_token = context.ProtocolMessage.IdToken;

                        var abc = new JwtSecurityToken(id_token);

                        var def = abc.Claims;

                        List<Claim> claims = new List<Claim>();

                        UserInfoClient userInfoClient = new UserInfoClient(new Uri("https://shaves2u.azurewebsites.net/core/connect/userinfo"), context.ProtocolMessage.AccessToken);

                        var userInfo = await userInfoClient.GetAsync();
                        userInfo.Claims.ToList().ForEach(ui => claims.Add(new Claim(ui.Item1, ui.Item2)));

                        return;

                        //return Task.FromResult(0);
                    },
                    RedirectToIdentityProvider = (context) =>
                    {
                        string appBaseUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase;
                        context.ProtocolMessage.RedirectUri = appBaseUrl + "/";
                        context.ProtocolMessage.PostLogoutRedirectUri = appBaseUrl + "/";

                        if (context.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
                        {
                            Claim idTokenHint = context.OwinContext.Authentication.User.FindFirst("id_token");

                            if (idTokenHint != null)
                            {
                                context.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                            }
                        }

                        return Task.FromResult(0);
                    },
                    AuthorizationCodeReceived = (context) =>
                    {
                        ClaimsIdentity identity = context.AuthenticationTicket.Identity;

                        identity.AddClaim(new Claim("id_token", context.ProtocolMessage.IdToken));

                        context.AuthenticationTicket = new Microsoft.Owin.Security.AuthenticationTicket(identity, context.AuthenticationTicket.Properties);

                        return Task.FromResult(0);
                    },
                    AuthenticationFailed = (context) =>
                    {
                        if (context.Exception.Message.StartsWith("OICE_20004") || context.Exception.Message.Contains("IDX10311"))
                        {
                            context.SkipToNextMiddleware();
                            return Task.FromResult(0);
                        }
                        return Task.FromResult(0);
                    }
                }
            };

From the code abc.Claims does not contain any claims from AspNetUserClaims nor does userInfo.Claims.

Can anyone help?

Answer 1

For anyone else experiencing the same issue, I would like to share my solution. In the end this turned out to be a configuration setting. Setting the IncludeAllClaimsForUser to true for the Scope. I created a new Scope for my application, however setting this property on the profile scope should also work.