{"action":"opened","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/466","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/466/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/466/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/466/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/466","id":187549337,"number":466,"title":"Missing iat claim from access token","user":{"login":"robisim74","id":14012361,"avatar_url":"https://avatars.githubusercontent.com/u/14012361?v=3","gravatar_id":"","url":"https://api.github.com/users/robisim74","html_url":"https://github.com/robisim74","followers_url":"https://api.github.com/users/robisim74/followers","following_url":"https://api.github.com/users/robisim74/following{/other_user}","gists_url":"https://api.github.com/users/robisim74/gists{/gist_id}","starred_url":"https://api.github.com/users/robisim74/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robisim74/subscriptions","organizations_url":"https://api.github.com/users/robisim74/orgs","repos_url":"https://api.github.com/users/robisim74/repos","events_url":"https://api.github.com/users/robisim74/events{/privacy}","received_events_url":"https://api.github.com/users/robisim74/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-06T09:48:30Z","updated_at":"2016-11-06T09:48:30Z","closed_at":null,"body":"Hi,\r\n\r\nI've implemented the resource owner password grant, and I get back an access token like this:\r\n\r\n```\r\n{\r\n \"nbf\": 1478420962,\r\n \"exp\": 1478421862,\r\n \"iss\": \"http://angular2spawebapi.azurewebsites.net\",\r\n \"aud\": \"http://angular2spawebapi.azurewebsites.net/resources\",\r\n \"client_id\": \"Angular2SPA\",\r\n \"sub\": \"c0bb2220-8c99-46dc-ad39-b707f37f047f\",\r\n \"auth_time\": 1478420962,\r\n \"idp\": \"local\",\r\n \"given_name\": \"Admin\",\r\n \"family_name\": \"Admin\",\r\n \"role\": \"administrator\",\r\n \"scope\": [\r\n  \"offline_access\",\r\n  \"WebAPI\"\r\n ],\r\n \"amr\": [\r\n  \"pwd\"\r\n ]\r\n}\r\n```\r\n_iat (issued at) claim_ is not present.\r\n\r\nIn the doc I read:\r\n> By default an access token will contain claims about the scope, lifetime (nbf and exp), the client ID (client_id) and the issuer name (iss).\r\n\r\nSo my question is: is it normal? to get the lifetime I should use _nbf_?\r\n\r\nOr am I doing something wrong?\r\n\r\nThis is the repository: https://github.com/robisim74/Angular2SPAWebAPI\r\nAnd this is the live example: http://angular2spawebapi.azurewebsites.net\r\n\r\nThanks.\r\n"}}
{"actor":{"display_login":"robisim74"}}