{"action":"opened","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1065","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1065/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1065/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1065/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1065","id":60749401,"number":1065,"title":"Requesting token with optional roles","user":{"login":"LorryMoller","id":5341561,"avatar_url":"https://avatars.githubusercontent.com/u/5341561?v=3","gravatar_id":"","url":"https://api.github.com/users/LorryMoller","html_url":"https://github.com/LorryMoller","followers_url":"https://api.github.com/users/LorryMoller/followers","following_url":"https://api.github.com/users/LorryMoller/following{/other_user}","gists_url":"https://api.github.com/users/LorryMoller/gists{/gist_id}","starred_url":"https://api.github.com/users/LorryMoller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LorryMoller/subscriptions","organizations_url":"https://api.github.com/users/LorryMoller/orgs","repos_url":"https://api.github.com/users/LorryMoller/repos","events_url":"https://api.github.com/users/LorryMoller/events{/privacy}","received_events_url":"https://api.github.com/users/LorryMoller/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-11T23:49:54Z","updated_at":"2015-03-11T23:49:54Z","closed_at":null,"body":"I have:\r\n- rest API server called by an untrusted client app\r\n- end users can have role1, role2, or both, which would control which API functions are accessible\r\n\r\nRather than asking for both 'role1' and 'role2' claims (will fail for users that only have one) can the client app ask for a token with all role claims?\r\n\r\nI tried the <a href=\"http://identityserver.github.io/Documentation/docs/configuration/scopesAndClaims.html\">Scopes and Claims example code</a> for 'role identity scope' but it returns a claim with a <B><I>value</I></B> of \"roles\" rather than a type of 'roles':\r\n\r\n  \"client_id\": \"MyClient\",\r\n  \"scope\": [\r\n    \"MyAdminApiScope\",\r\n    \"roles\"\r\n  ],\r\n  \"sub\": \"20338afc-3e0b-447e-813b-5ba6aa81eda3\",\r\n...\r\n\r\nVarious combinations of 'role' and 'roles' (such as StandardScopes.Roles) always seem to give me that. So I'm not sure what this is used for - is it to get an access token that can get roles from the UserInfo endpoint?\r\n\r\nIf I use the IncludeAllClaimsForUser flag for that app I get the role information in the access token how I want:\r\n\r\n  \"role\": [\r\n    \"RoleCustomerAdmin\",\r\n    \"RoleVendorAdmin\"\r\n  ],\r\n\r\nbut also other claim information that I may not want the untrusted client app to have.\r\n\r\nI think my options are (Can anyone confirm?):\r\na) stateless API server asks the userinfo endpoint for roles during each api call (poor performance)\r\nb) client app asks for one token per role/claim (multiple signins?)\r\nc) customize identity server, similar to <a href=\"https://github.com/IdentityServer/IdentityServer3/issues/147\">issue 147</a> (requires internal knowledge of idsrv3 so could break in a future release?)\r\nd) something I'm missing about the example that will give me what I want\r\n\r\nI would think my case would be a very common way of using roles, so hopefully it is option d... if it is c, that would be a good feature to add. "}}