I have a Identity Server client set up to be able to use the password and authorization code grants, I am able to use both, but when reviewing the tokens they do not contain the same claims, is this how its suppose to work or I am missing some configuration?

If this is how it works (different claims in each grant) when using the password grant should I use the Profile service to add the other claims?

CodePudding user response：

You need to implement an IResourceOwnerPasswordValidator, and return the list of claims you need. The default implementation only sends the sub claim.

See the example implementation for ASP.NET Core Identity in IdentityServer repo.

Then modify it to send additional claims. Or use ProfileService to populate it:

public virtual async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
{
    var user = await _userManager.FindByNameAsync(context.UserName);
    if (user != null)
    {
        var result = await _signInManager.CheckPasswordSignInAsync(user, context.Password, true);
        if (result.Succeeded)
        {
            var sub = await _userManager.GetUserIdAsync(user);

            _logger.LogInformation("Credentials validated for username: {username}", context.UserName);

            // return additional claims
            var claims = await _userManager.GetClaimsAsync(user);
            context.Result = new GrantValidationResult(sub, AuthenticationMethods.Password, claims);
            return;
        }
    // ... see the link above for a full implementation
}

You can also create a new ClaimsPrincipal to populate the results. See the GrantValidationResult constructor overloads for other options.