IdentityServer4 and UserInfo endpoint customization

Question

I have created an IdentityServer4 application, if I login inside that application the user claims are all good. If I login from another client application (MVC) the UserInfo endpoint doesn't return the same claims.

The IdentityServer is configured with ASP.NET Identity, so the UserProfile is already configured to return all UserClaims, like the one I created.

I don't understand why it's not showed on consent view or it's not included in UserInfo endpoint result

Answer 1

Please check for the below points if they can solve your issue

1.) Your Identity resource and API resource should have the required UserClaims.

2.) Check if there is some custom logic to issue requested claims for userinfo endpoint in your profile service.

public class ProfileService : IProfileService
{
    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        if (context.Caller == IdentityServerConstants.ProfileDataCallers.UserInfoEndpoint)
        { 
            //custom logic to add requested claims 
            context.AddRequestedClaims(claims);
        }
    }
}

3.) Try to make the property 'GetClaimsFromUserInfoEndpoint=true' in your MVC client AddOpenIdConnect configuration.

Answer 2

have you configured your IdentityResources? Something like:

services.AddIdentityServer()

                .AddInMemoryIdentityResources(GetIdentityResources())

//where
public static List<IdentityResource> GetIdentityResources()
{
  // Claims automatically included in OpenId scope
  var openIdScope = new IdentityResources.OpenId();
  openIdScope.UserClaims.Add(JwtClaimTypes.Locale);

  // Available scopes
  return new List<IdentityResource>
  {
    openIdScope,
    new IdentityResources.Profile(),
    new IdentityResources.Email(),
    new IdentityResource(Constants.RolesScopeType, Constants.RolesScopeType,
      new List<string> {JwtClaimTypes.Role, Constants.TenantIdClaimType})
      {
        //when false (default), the user can deselect the scope on consent screen
        Required = true 
      }
  };
}