title: AccessToken is null for identity server client
body: <p>I have following openid options:</p>
  
  <pre><code> app.UseCookieAuthentication(new CookieAuthenticationOptions
              {
                  AuthenticationType = "Cookies",
              });
  
  
  
              app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
              {
                  AuthenticationType = "oidc",
                  SignInAsAuthenticationType = "Cookies",
                  Authority = "http://localhost:5000",              
                  ClientId = "mvcClient",
                  ClientSecret = "secret",
                  RedirectUri = "http://localhost:5002/signin-oidc",
                  PostLogoutRedirectUri = "http://localhost:5002",
                  ResponseType = "code id_token",                            
                  Scope = "openid profile",
  
                  Notifications = new OpenIdConnectAuthenticationNotifications
                  {
                      SecurityTokenValidated = async n =&gt;
                      {
                          var claims_to_exclude = new[]
                          {
                              "aud", "iss", "nbf", "exp", "nonce", "iat", "at_hash"
                          };
  
                          var claims_to_keep =
                              n.AuthenticationTicket.Identity.Claims
                              .Where(x =&gt; false == claims_to_exclude.Contains(x.Type)).ToList();
                          claims_to_keep.Add(new Claim("id_token", n.ProtocolMessage.IdToken));
  
  
  
  
                          if (n.ProtocolMessage.AccessToken != null)
                          {
                              claims_to_keep.Add(new Claim("access_token", n.ProtocolMessage.AccessToken));
  
     }    
    }    
   }
  }
  </code></pre>
  
  <p>I see n.ProtocolMessage.AccessToken is always null.</p>
  
  <p>I configured client in identity server like this:</p>
  
  <pre><code> new Client()
                  {
                      ClientId = "mvcClient",
                      ClientName = "MVC Client",                      
                      AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
  
                      ClientSecrets = new List&lt;Secret&gt;()
                      {
                          new Secret("secret".Sha256())
                      },
  
                     // RequireConsent = false,
  
                      // where to redirect to after login
                      RedirectUris = { "http://localhost:5002/signin-oidc" },
                      // where to redirect to after logout
                      PostLogoutRedirectUris = { "http://localhost:5002" },
  
                      AllowedScopes =
                      {
                          StandardScopes.OpenId.Name,
                          StandardScopes.Profile.Name,
                          StandardScopes.OfflineAccess.Name,
                          StandardScopes.Roles.Name,
                          "API"
                      }
                  },
  </code></pre>
  
  <p>I want to know why n.ProtocolMessage.AccessToken is null and how can i get its value</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>If I change Client Type to Hybrid like this:</p>
  
  <p>AllowedGrantTypes = GrantTypes.Hybrid,</p>
  
  <p>and ResponseType = "code id_token token:</p>
  
  <p>I get invalid_request error on server</p>
  
  <p>If I try to get access token like this (in notifications):</p>
  
  <pre><code>var client = new TokenClient("http://localhost:5000/connect/token", "mvcClient", "secret");
                              var response = client.RequestClientCredentialsAsync("testscope").Result;
                              var accesstoken = response.AccessToken;
                              claims_to_keep.Add(new Claim("access_token", accesstoken));
  </code></pre>
  
  <p>The result token has only one scope(i.e testscope) instead of all other scopes defined for that client.</p>