Using AWS Cognito with Identity server I am unable to obtain the full claims in either the id_token or access_token (from my client app).
One of the attributes we need to obtain is the email, this is enabled in the app pool client:
When I query the tokens in my client app, the email claim is not present.
Even stranger, when I run the below code on the Identity Server application I can see all the claims that I need:
I am unsure why my client application does not have access to the same claims.
In the end I implemented ProfileService and added the claims there.
One thing I didn't understand at first was that it is the client app that fires the GetProfileDataAsync method, and not the Identity Server itself.
See: https://jaliyaudagedara.blogspot.com/2020/04/identityserver4-adding-additional.html