{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1185","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1185/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1185/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1185/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1185","id":68084054,"number":1185,"title":"Strange: Accesstoken contains role claim, webapi client has it too, but in webapp role is not there?!?","user":{"login":"davidmrichter","id":9887781,"avatar_url":"https://avatars.githubusercontent.com/u/9887781?v=3","gravatar_id":"","url":"https://api.github.com/users/davidmrichter","html_url":"https://github.com/davidmrichter","followers_url":"https://api.github.com/users/davidmrichter/followers","following_url":"https://api.github.com/users/davidmrichter/following{/other_user}","gists_url":"https://api.github.com/users/davidmrichter/gists{/gist_id}","starred_url":"https://api.github.com/users/davidmrichter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidmrichter/subscriptions","organizations_url":"https://api.github.com/users/davidmrichter/orgs","repos_url":"https://api.github.com/users/davidmrichter/repos","events_url":"https://api.github.com/users/davidmrichter/events{/privacy}","received_events_url":"https://api.github.com/users/davidmrichter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-04-13T12:23:22Z","updated_at":"2015-04-17T17:07:36Z","closed_at":null,"body":"I have an identityserver setup to use an other Wsfederation Identityserver for Login. The user logs in via [Authorize] on an MVC Controller. then the accesstoken is being added to the HttpRequest header to an Rest WebApi. In the RestWebapi controller one can see that the User’s role is in the claims, as intented. If I check the Principal on MVC Webapp side the user’s role is not in the claims.\r\n\r\n Why is that?\r\n\r\nHere are the details:\r\nThe identityserver get configured to use another identityserver for Login. Before it generates its own token it adds role claim and name claim to the received token via SecurityTokenValidated callback as following:\r\n```\r\nvar adfs = new WsFederationAuthenticationOptions\r\n\t\t\t{\r\n\t\t\t\tAuthenticationType = \"Nevis\",\r\n\t\t\t\tCaption = \"Nevis\",\r\n\t\t\t\tSignInAsAuthenticationType = p_SignInAsType,\r\n                MetadataAddress = Configs.NevisSurrogateURI + \"/wsfed/metadata\",\r\n\t\t\t\tWtrealm = \"urn:testrp\",\r\n\t\t\t\tNotifications = new WsFederationAuthenticationNotifications\r\n\t\t\t\t{\r\n\t\t\t\t\t// TODO extract this as proposed in http://identityserver.github.io/Documentation/docs/advanced/userService.html\r\n\t\t\t\t\tSecurityTokenValidated = n =>\r\n\t\t\t\t\t{\r\n                        // later transform(enrich) the claims from Nevis with our company Service roles\r\n\t\t\t\t\t\tvar incomingClaimsFromAdfs = n.AuthenticationTicket.Identity.Claims.ToList();\r\n\t\t\t\t\t\tvar theExtUser = incomingClaimsFromAdfs.First(c => c.Type == Constants.ClaimTypes.Subject).Value;\r\n                        // add this claim since NEVIS external identification results in \"sub\" with GUIDs\r\n                        incomingClaimsFromAdfs.Add(new Claim(Constants.ClaimTypes.Name, theExtUser));\r\n\r\n\t\t\t\t\t    var theIdentityServerUser = Users.Get().First(u => u.Subject == theExtUser);\r\n\t\t\t\t\t\tvar theNewUserClaims = theIdentityServerUser.Claims.Union(incomingClaimsFromAdfs).Distinct(new ClaimComparer());\r\n                        \r\n\t\t\t\t\t\tvar claimsIdentity = new ClaimsIdentity(theNewUserClaims, n.AuthenticationTicket.Identity.AuthenticationType);\r\n\t\t\t\t\t\tn.AuthenticationTicket = new AuthenticationTicket(claimsIdentity, n.AuthenticationTicket.Properties);\r\n\t\t\t\t\t\treturn Task.FromResult(0);\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t};\r\n\t\t\tp_App.UseWsFederationAuthentication(adfs);\r\n```\r\nthe Tokens are here at the end of the method above:\r\n\r\n![image](https://cloud.githubusercontent.com/assets/9887781/7115355/3ef49bee-e1e8-11e4-9e9f-ecf5cf4b66fb.png)\r\n\r\nOne can see that the role is there.\r\n\r\n\r\nThen at the WebAppclient(Hybridflow) \r\n```\r\nJwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>();\r\n            AntiForgeryConfig.UniqueClaimTypeIdentifier = \"sub\"; //Thinktecture.IdentityServer.Core.Constants.ClaimTypes.Subject;\r\n            \r\n\r\n            app.UseCookieAuthentication(new CookieAuthenticationOptions\r\n            {\r\n                AuthenticationType = \"Cookies\"\r\n            });\r\n\r\n            app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions\r\n            {\r\n                ClientId = \"CodeClient\",\r\n                Authority = Configs.IdentityAccessServiceURI,\r\n                RedirectUri = Configs.WebAppRedirectURI,\r\n                PostLogoutRedirectUri = Configs.WebAppPostLogoutRedirectURI,\r\n                ResponseType = \"code id_token token\",\r\n                Scope = \"openid email profile offline_access WebApp\",\r\n\r\n                SignInAsAuthenticationType = \"Cookies\",\r\n                \r\n                Notifications = new OpenIdConnectAuthenticationNotifications\r\n                {\r\n                    SecurityTokenValidated = async n =>\r\n                    {\r\n                        //Access Token is automatically validated by identityserver\r\n                        var token = n.ProtocolMessage.AccessToken;\r\n                        n.Response.Cookies.Append(\"AccessToken\", token, new CookieOptions(){Secure = true, HttpOnly = false});\r\n                        n.Response.Cookies.Append(\"RestApiURI\", Configs.RestApiURI, new CookieOptions() { Secure = true, HttpOnly = false });\r\n                    },\r\nIn the SecurityTokenValidated callback the role is not available.\r\n![image](https://cloud.githubusercontent.com/assets/9887781/7115366/5a9381ee-e1e8-11e4-8c66-0610c2ec8832.png)\r\n\r\nThe WebApp sends the request to the webapi like:\r\ncommunicationModule.config(['$httpProvider', function ($httpProvider) {\r\n    $httpProvider.interceptors.push(function ($q, $cookies) {\r\n        return {\r\n            'request': function (config) {\r\n                config.headers['Authorization'] = 'Bearer ' + $cookies.AccessToken;\r\n                return config;\r\n            }\r\n        };\r\n    });\r\n}]);\r\n```\r\n\r\nThen at the rest API:\r\n```\r\npublic void Configuration(IAppBuilder app)\r\n\t\t{\r\n\t\t\tJwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>();\r\n\r\n\t\t\tapp.UseIdentityServerBearerTokenAuthentication(\r\n\t\t\t\tnew IdentityServerBearerTokenAuthenticationOptions { Authority = Configs.IdentityAccessServiceURI, RequiredScopes = new[] { \"WebApp\" } });            \r\n\t\t\tapp.UseResourceAuthorization(new AuthorizationManager());\r\n\t\t}\r\nAnd in the Controller’s action:\r\npublic JToken Get()\r\n\t\t{\r\n\t\t\tvar principal = this.Request.GetRequestContext().Principal as ClaimsPrincipal;\r\n![image](https://cloud.githubusercontent.com/assets/9887781/7115373/6b07a1f4-e1e8-11e4-873e-4b0c2a1cf8e7.png)\r\n```\r\nAnd voila there is the role!!!\r\nThere does the role come from?!???\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/94028668","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1185#issuecomment-94028668","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1185","id":94028668,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2015-04-17T17:07:35Z","updated_at":"2015-04-17T17:07:35Z","body":"I'm unsure where this issue is -- are you all set now? "}}