Owin not authenticated when requesting access token

Question

I'm using implicit grant type, and when I request "id_token token" as response type my HttpContext.Current.User is null after logging in leading me to believe something has gone wrong inside owin. If I just have "id_token" as response type its fine. Do I need to tell owin somewhere to get the access token?

For reference I'm using .Net Framework as my client and identityserver4.

Answer 1

To be able to get the token via browser you need to set AllowAccessTokensViaBrowser = true on client's config within IdentityServer:

                new Client
                {
                    ...

                    AllowedGrantTypes = GrantTypes.Implicit,
                    AllowAccessTokensViaBrowser = true,

                    ...
                },

and on MVC client's Startup, to you can add the access_token as a claim to user:

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
            {
                ...
                ResponseType = "id_token token",             

                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    SecurityTokenValidated = n =>
                    {
                        n.AuthenticationTicket.Identity.AddClaim(new Claim("access_token", n.ProtocolMessage.AccessToken));
                        
                        return Task.FromResult(0);
                    }
                }
            });

I have the full working sample here