{"action":"opened","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.Samples/issues/265","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.Samples","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.Samples/issues/265/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.Samples/issues/265/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.Samples/issues/265/events","html_url":"https://github.com/IdentityServer/IdentityServer3.Samples/issues/265","id":152544926,"number":265,"title":"Should unverified accounts return their claims when UserInfo is requested?","user":{"login":"HenrikWM","id":1481951,"avatar_url":"https://avatars.githubusercontent.com/u/1481951?v=3","gravatar_id":"","url":"https://api.github.com/users/HenrikWM","html_url":"https://github.com/HenrikWM","followers_url":"https://api.github.com/users/HenrikWM/followers","following_url":"https://api.github.com/users/HenrikWM/following{/other_user}","gists_url":"https://api.github.com/users/HenrikWM/gists{/gist_id}","starred_url":"https://api.github.com/users/HenrikWM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HenrikWM/subscriptions","organizations_url":"https://api.github.com/users/HenrikWM/orgs","repos_url":"https://api.github.com/users/HenrikWM/repos","events_url":"https://api.github.com/users/HenrikWM/events{/privacy}","received_events_url":"https://api.github.com/users/HenrikWM/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-05-02T12:38:44Z","updated_at":"2016-05-02T12:38:44Z","closed_at":null,"body":"Hi,\r\n\r\nI've come across an issue when implementing authentication with *MembershipReboot* users that go through a two-step login. They will not be marked as verified by my `UserService` until they have completed login with a 2fa-code, and I use *MembershipReboot's* 2fa-feature for this. Until they successfully authenticate, their `UserAccount` is marked as `IsAccountVerified=false` and will be deleted by a continually-running cleanup-task after a while.\r\n\r\nNow, if you call the `/connect/userinfo` endpoint with an `access_token` belonging to a user with an unverified account, should it return claims and 200 OK? The [OpenID-spec](https://openid.net/specs/openid-connect-basic-1_0.html#UserInfo) says:\r\n\r\n> The UserInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the **authenticated **End-User.\r\n\r\nSo just wondering if the `IsActiveAsync` method in `MembershipRebootUserService` should be changed to be stricter and check the `IsAccountVerified` property as well.\r\n\r\n`ctx.IsActive = acct != null && !acct.IsAccountClosed && acct.IsLoginAllowed;`\r\n\r\nto\r\n\r\n`ctx.IsActive = acct != null && !acct.IsAccountClosed && acct.IsLoginAllowed && acct.IsAccountVerified;`\r\n\r\nThis will cause the `ValidateAccessTokenAsync` called from the `GetUserInfo` of `UserInfoEndpointController` in *IdentityServer* to return `invalid_token` for unverified accounts. \r\n\r\nCurious to hear your thoughts on this :)"}}