{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/531","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/531/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/531/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/531/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/531","id":193275423,"number":531,"title":"validating claims on resource server no longer works after rc4 update","user":{"login":"damienbod","id":3442158,"avatar_url":"https://avatars.githubusercontent.com/u/3442158?v=3","gravatar_id":"","url":"https://api.github.com/users/damienbod","html_url":"https://github.com/damienbod","followers_url":"https://api.github.com/users/damienbod/followers","following_url":"https://api.github.com/users/damienbod/following{/other_user}","gists_url":"https://api.github.com/users/damienbod/gists{/gist_id}","starred_url":"https://api.github.com/users/damienbod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/damienbod/subscriptions","organizations_url":"https://api.github.com/users/damienbod/orgs","repos_url":"https://api.github.com/users/damienbod/repos","events_url":"https://api.github.com/users/damienbod/events{/privacy}","received_events_url":"https://api.github.com/users/damienbod/received_events","type":"User","site_admin":false},"labels":[{"id":290038719,"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-12-03T08:48:01Z","updated_at":"2016-12-03T20:11:06Z","closed_at":"2016-12-03T20:11:06Z","body":"When validating a role claim using policies on the resource server, a claim is not returned by identityServer4 and the user has no access. The user is valid, if I just validate without using the claim, access is ok. Before the update the claims could be validated using policies. \r\n\r\nTesting with a user that has all claims. The claims are no longer returned from the IdentityServer4 to the resource server.\r\n\r\nStartup Resource Server\r\n```\r\nJwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();\r\n\r\nIdentityServerAuthenticationOptions identityServerValidationOptions = new IdentityServerAuthenticationOptions\r\n{\r\n\tAuthority = \"https://localhost:44318/\",\r\n\tAllowedScopes = new List<string> { \"dataEventRecords\" },\r\n\tApiSecret = \"dataEventRecordsSecret\",\r\n\tApiName = \"dataEventRecords\",\r\n\tAutomaticAuthenticate = true,\r\n\tSupportedTokens = SupportedTokens.Both,\r\n\t// TokenRetriever = _tokenRetriever,\r\n\t// required if you want to return a 403 and not a 401 for forbidden responses\r\n\r\n\tAutomaticChallenge = true,\r\n\t\r\n};\r\n\r\napp.UseIdentityServerAuthentication(identityServerValidationOptions);\r\n```\r\n\r\nPolicy\r\n```\r\n services.AddAuthorization(options =>\r\n            {\r\n                options.AddPolicy(\"dataEventRecordsAdmin\", policyAdmin =>\r\n                {\r\n                    policyAdmin.RequireClaim(\"role\", \"dataEventRecords.admin\");\r\n                });\r\n                options.AddPolicy(\"dataEventRecordsUser\", policyUser =>\r\n                {\r\n                    policyUser.RequireClaim(\"role\",  \"dataEventRecords.user\");\r\n                });\r\n\r\n            });\r\n```\r\nController\r\n```\r\n   [Authorize]\r\n    [Route(\"api/[controller]\")]\r\n    public class DataEventRecordsController : Controller\r\n    {\r\n        private readonly IDataEventRecordRepository _dataEventRecordRepository;\r\n\r\n        public DataEventRecordsController(IDataEventRecordRepository dataEventRecordRepository)\r\n        {\r\n            _dataEventRecordRepository = dataEventRecordRepository;\r\n        }\r\n\r\n        [Authorize(\"dataEventRecordsUser\")]\r\n        [HttpGet]\r\n        public IActionResult Get()\r\n        {\r\n            return Ok(_dataEventRecordRepository.GetAll());\r\n        }\r\n```"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/comments/264662554","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/531#issuecomment-264662554","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/531","id":264662554,"user":{"login":"damienbod","id":3442158,"avatar_url":"https://avatars.githubusercontent.com/u/3442158?v=3","gravatar_id":"","url":"https://api.github.com/users/damienbod","html_url":"https://github.com/damienbod","followers_url":"https://api.github.com/users/damienbod/followers","following_url":"https://api.github.com/users/damienbod/following{/other_user}","gists_url":"https://api.github.com/users/damienbod/gists{/gist_id}","starred_url":"https://api.github.com/users/damienbod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/damienbod/subscriptions","organizations_url":"https://api.github.com/users/damienbod/orgs","repos_url":"https://api.github.com/users/damienbod/repos","events_url":"https://api.github.com/users/damienbod/events{/privacy}","received_events_url":"https://api.github.com/users/damienbod/received_events","type":"User","site_admin":false},"created_at":"2016-12-03T20:11:06Z","updated_at":"2016-12-03T20:11:06Z","body":"@robisim74 Thanks a million! I had the UserClaims defined, but at the wrong level and also the scope, ApiResource did not match. Very confusing the new configuration API.\r\n\r\nThanks \r\nGreetings Damien"}}
{"actor":{"display_login":"damienbod"}}