{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/826","labels_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/826/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/826/comments","events_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/826/events","html_url":"https://github.com/IdentityServer/Thinktecture.IdentityServer3/issues/826","id":55526017,"number":826,"title":"Reference Token Validation throws exception","user":{"login":"TD49","id":9612741,"avatar_url":"https://avatars.githubusercontent.com/u/9612741?v=3","gravatar_id":"","url":"https://api.github.com/users/TD49","html_url":"https://github.com/TD49","followers_url":"https://api.github.com/users/TD49/followers","following_url":"https://api.github.com/users/TD49/following{/other_user}","gists_url":"https://api.github.com/users/TD49/gists{/gist_id}","starred_url":"https://api.github.com/users/TD49/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TD49/subscriptions","organizations_url":"https://api.github.com/users/TD49/orgs","repos_url":"https://api.github.com/users/TD49/repos","events_url":"https://api.github.com/users/TD49/events{/privacy}","received_events_url":"https://api.github.com/users/TD49/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/labels/bug?!","name":"bug?!","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2015-01-26T19:30:21Z","updated_at":"2015-01-26T20:30:31Z","closed_at":null,"body":"While we have successfully retrieved and validated self-contained JWT-based Access Tokens, I'm having issues validating a Reference Token type using the token validation endpoint (with the default in-memory ```TokenValidationStore```).\r\n\r\nRequest to the validator (using a fake ref token for this post):  \r\n```https://myidsvr3/core/connect/accesstokenvalidation?token=2fc954023e5f71286ac5d018e301f8f7 GET```\r\n\r\nIt fails with a System.NullReferenceException when adding claims to the ClaimsIdentity, starting here:  https://github.com/IdentityServer/Thinktecture.IdentityServer3/blob/master/source/Core/Services/Default/DefaultCustomTokenValidator.cs#L78\r\n\r\nStacktrace snippet:\r\n```\r\nExceptionType: \"System.NullReferenceException\"\r\nStackTrace: \" at System.Security.Claims.ClaimsIdentity.SafeAddClaims(IEnumerable`1 claims) at System.Security.Claims.ClaimsIdentity..ctor(IIdentity identity, IEnumerable`1 claims, String authenticationType, String nameType, String roleType, Boolean checkAuthType) at System.Security.Claims.ClaimsIdentity..ctor(IIdentity identity, IEnumerable`1 claims, String authenticationType, String nameType, String roleType) at Thinktecture.IdentityServer.Core.Services.Default.DefaultCustomTokenValidator.<ValidateAccessTokenAsync>d__4.MoveNext() in c:\\etc\\Dropbox\\thinktecture\\IdentityServer.v3\\Core\\source\\Core\\Services\\Default\\DefaultCustomTokenValidator.cs:line 78 \r\n```\r\nNote that, for the above example, there are no custom claims or anything special being added or used with the Client.  The token was originally retrieved through an RO grant type request. We're using IdSvr3 RTM released yesterday.  Any ideas?\r\n\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/comments/71532164","html_url":"https://github.com/IdentityServer/Thinktecture.IdentityServer3/issues/826#issuecomment-71532164","issue_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/826","id":71532164,"user":{"login":"TD49","id":9612741,"avatar_url":"https://avatars.githubusercontent.com/u/9612741?v=3","gravatar_id":"","url":"https://api.github.com/users/TD49","html_url":"https://github.com/TD49","followers_url":"https://api.github.com/users/TD49/followers","following_url":"https://api.github.com/users/TD49/following{/other_user}","gists_url":"https://api.github.com/users/TD49/gists{/gist_id}","starred_url":"https://api.github.com/users/TD49/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TD49/subscriptions","organizations_url":"https://api.github.com/users/TD49/orgs","repos_url":"https://api.github.com/users/TD49/repos","events_url":"https://api.github.com/users/TD49/events{/privacy}","received_events_url":"https://api.github.com/users/TD49/received_events","type":"User","site_admin":false},"created_at":"2015-01-26T20:30:31Z","updated_at":"2015-01-26T20:30:31Z","body":"You're correct, I couldn't repro using the IdSvr3 Core host from the source code repo (master).     \r\n\r\nThe only difference on our setup is that we're using a custom user service to validate credentials, but that shouldn't cause our issue as a reference token is still being issued.  The validation endpoint is able to trap it when the reference token is expired or invalid (with the \"invalid_token\" response).   Plus I can see the claims.    From the earlier stacktrace, I take it somehow a custom claim is being added that it can't process...  I'll keep digging, at a loss for the moment."}}