Additional claims set from IProfileService not available in MVC client's OpenIdConnect handler

Question

I am using Identity Server 4 running on .NET Core with a .NET Framework v4.6.2 MVC app. I use profile service to set additional claims from the Identity Server:

public async Task GetProfileDataAsync(ProfileDataRequestContext context)
        {
            if (context.Caller.Equals("ClaimsProviderAccessToken") || context.Caller.Equals("ClaimsProviderIdentityToken"))
            {
                foreach (var group in groups)
                {
                    // Custom logic to add additional claims.
                    context.IssuedClaims.Add(new Claim(ClaimTypes.Role, groupName));
                }
            }
        }

        public Task IsActiveAsync(IsActiveContext context)
        {
            return Task.CompletedTask;
        }

The additional claims set from here are available to the client when I tried with a .NET Core MVC Client. But, in the case of an MVC client running in ASP.NET Framework, these claims are not available in context.AuthenticationTicket.Identity.Claims. But the claims are there when I inspect the access token from context.ProtocolMessage.AccessToken.

 app.UseCookieAuthentication(new CookieAuthenticationOptions
                                            {
                                                ExpireTimeSpan = new TimeSpan(0, Configuration.SessionTimeoutInMinutes, 0),
                                                SlidingExpiration = true,
                                                CookieSameSite = Microsoft.Owin.SameSiteMode.None,
                                                CookieSecure = CookieSecureOption.Always
                                            });

                app.UseOpenIdConnectAuthentication(
                    new OpenIdConnectAuthenticationOptions
                    {
                        
                        ClientId = clientId,
                        Authority = authority,
                        RedirectUri = redirectUri,
                        PostLogoutRedirectUri = redirectUri,
                        ResponseType = "id_token token",
                        Scope = "openid profile roles api",
                        TokenValidationParameters = new TokenValidationParameters
                        {
                            ValidateIssuer = false,
                        },
                        Notifications = new OpenIdConnectAuthenticationNotifications()
                        {
                            SecurityTokenValidated = (context) =>
                            {
                                // The claims are not available here.
                                foreach (var claim in context.AuthenticationTicket.Identity.Claims.Where(x => x.Type == JwtClaimTypes.Role).ToList())
                                {
                                    context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Role, claim.Value));
                                }

                                // But, the claims are available in the access token.
                                context.Response.Cookies.Append("access-token", context.ProtocolMessage.AccessToken, new Microsoft.Owin.CookieOptions() { SameSite = Microsoft.Owin.SameSiteMode.None, Secure = true });
                                return Task.FromResult(0);
                            },
                        }
                    });

What is going wrong here? Please let me know if I need to post more code.

Answer 1

Use AlwaysIncludeUserClaimsInIdToken = true while registering the MVC client in Identity Server.