{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1362","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1362/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1362/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1362/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1362","id":76696653,"number":1362,"title":"IdToken through Resource owner password flow ","user":{"login":"danutzplusplus","id":10243023,"avatar_url":"https://avatars.githubusercontent.com/u/10243023?v=3","gravatar_id":"","url":"https://api.github.com/users/danutzplusplus","html_url":"https://github.com/danutzplusplus","followers_url":"https://api.github.com/users/danutzplusplus/followers","following_url":"https://api.github.com/users/danutzplusplus/following{/other_user}","gists_url":"https://api.github.com/users/danutzplusplus/gists{/gist_id}","starred_url":"https://api.github.com/users/danutzplusplus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danutzplusplus/subscriptions","organizations_url":"https://api.github.com/users/danutzplusplus/orgs","repos_url":"https://api.github.com/users/danutzplusplus/repos","events_url":"https://api.github.com/users/danutzplusplus/events{/privacy}","received_events_url":"https://api.github.com/users/danutzplusplus/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"milestone":null,"comments":14,"created_at":"2015-05-15T11:19:53Z","updated_at":"2015-05-28T17:43:02Z","closed_at":"2015-05-23T10:05:50Z","body":"Hello,\r\n\r\nI've an issue and would like to if this is just not supported, or if I'm doing something wrong.\r\n\r\nI've a native app (winforms) and would like to perform token requests from it, using resource owner password flow (sending both client and user credentials) (implicit flow through a webview kind of works, but we don't like having to keep that webview around in order to keep the auth cookie alive).\r\n\r\nSo, the issue first with establishing identity in the native client. From what I can see IdServer V3 doesn't support issueing idtokens, even if I request openid as a scope. It issues an access token but no id token. Is this not supported? \r\n\r\nThe second issue I forsee, (haven't reached that point yet), if the client requests an access token with certain scopes to access certain webapi services, with a refresh token you can only refresh the lifetime of that token, but not change the scopes (which sounds fine from a security point). But then what's the alternative? Either perform the request again (either asking the user again for credentials, or caching them), or make the initial access token request with all the scopes you might need? But then doesn't that make the token highly risky? (if it gets leaked it basically can access a lot of webapi services).\r\n\r\nWorst case, I can get the identity from the access token, but then I'm left with not being able to verify the \"aud\" field on the token. \r\n\r\nThanks, and I hope someone can clear this for me. "},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/106518876","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1362#issuecomment-106518876","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1362","id":106518876,"user":{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"created_at":"2015-05-28T17:43:01Z","updated_at":"2015-05-28T17:43:01Z","body":"You need to establish identity if you are protecting resources on the client on behalf of the user. If the client is just a \"service frontend\" i think it is sufficient to simply forward the token to the API and it will be validated then."}}