{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1356","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1356/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1356/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1356/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/1356","id":244988133,"number":1356,"title":"Option for adding user claims in the access token missing","user":{"login":"MovGP0","id":83339,"avatar_url":"https://avatars3.githubusercontent.com/u/83339?v=4","gravatar_id":"","url":"https://api.github.com/users/MovGP0","html_url":"https://github.com/MovGP0","followers_url":"https://api.github.com/users/MovGP0/followers","following_url":"https://api.github.com/users/MovGP0/following{/other_user}","gists_url":"https://api.github.com/users/MovGP0/gists{/gist_id}","starred_url":"https://api.github.com/users/MovGP0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MovGP0/subscriptions","organizations_url":"https://api.github.com/users/MovGP0/orgs","repos_url":"https://api.github.com/users/MovGP0/repos","events_url":"https://api.github.com/users/MovGP0/events{/privacy}","received_events_url":"https://api.github.com/users/MovGP0/received_events","type":"User","site_admin":false},"labels":[{"id":290038719,"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2017-07-24T06:59:57Z","updated_at":"2017-08-01T19:43:16Z","closed_at":"2017-07-26T20:05:37Z","body":"- [x] I read and understood how to enable [logging](https://identityserver4.readthedocs.io/en/release/topics/logging.html)\r\n\r\n### Issue / Steps to reproduce the problem\r\nI want to send custom user claims with the access token. It should be possible to do so based on the Scope.UserClaims configuration. \r\n\r\nExample: \r\n\r\n**Config.cs**\r\n```csharp\r\n        public static IEnumerable<Scope> GetScopes()\r\n        {\r\n            // other scopes\r\n\r\n            yield return new Scope\r\n            {\r\n                Name = \"roles\", \r\n                DisplayName = \"Roles\", \r\n                Description = \"\", \r\n                UserClaims = new[] {\r\n                    @\"http://schemas.microsoft.com/ws/2008/06/identity/claims/role\"\r\n                },\r\n                ShowInDiscoveryDocument = true,\r\n                Required = false,\r\n                Emphasize = true\r\n            };\r\n        }\r\n\r\n        public static IEnumerable<Client> GetClients()\r\n        {\r\n            yield return new Client\r\n            {\r\n                AllowedGrantTypes = GrantTypes.Implicit,\r\n                AllowedScopes = { \"roles\" },\r\n                AccessTokenType = AccessTokenType.Jwt,\r\n                AlwaysSendClientClaims = true,\r\n                AlwaysIncludeUserClaimsInIdToken = true, \r\n                AlwaysIncludeUserClaimsInAccessToken = true, \r\n                // ....\r\n            };\r\n```\r\nWhat I am expecting here is the `Client.AlwaysIncludeUserClaimsInAccessToken` option, which should enrich the access token with the user claims that are specified in the `Scope` object. This is currently possible by implementing a custom `ITokenService`, but I guess it may work without that. "},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/comments/319475595","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/1356#issuecomment-319475595","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1356","id":319475595,"user":{"login":"MovGP0","id":83339,"avatar_url":"https://avatars3.githubusercontent.com/u/83339?v=4","gravatar_id":"","url":"https://api.github.com/users/MovGP0","html_url":"https://github.com/MovGP0","followers_url":"https://api.github.com/users/MovGP0/followers","following_url":"https://api.github.com/users/MovGP0/following{/other_user}","gists_url":"https://api.github.com/users/MovGP0/gists{/gist_id}","starred_url":"https://api.github.com/users/MovGP0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MovGP0/subscriptions","organizations_url":"https://api.github.com/users/MovGP0/orgs","repos_url":"https://api.github.com/users/MovGP0/repos","events_url":"https://api.github.com/users/MovGP0/events{/privacy}","received_events_url":"https://api.github.com/users/MovGP0/received_events","type":"User","site_admin":false},"created_at":"2017-08-01T19:43:16Z","updated_at":"2017-08-01T19:43:16Z","body":"btw: there are at least two schemes for roles: `IdentityModel.JwtClaimTypes.Role` (value: `role`) and `System.Security.Claims.ClaimTypes.Role` (value: `http://schemas.microsoft.com/ws/2008/06/identity/claims/role`). You might want to support both. "}}
{"actor":{"display_login":"MovGP0"}}