title: Complex JSON Web Token Array in webapi with OWIN
body: <p>I'm in process of trying to learn JWT and ouath. I have came across form of JWT which would help me in development of my authorization server. </p>
  
  <p>The format I came across is following : </p>
  
  <pre><code>{
    iat: 1416929061, 
    jti: "802057ff9b5b4eb7fbb8856b6eb2cc5b",
    scopes: {
      users: {
        actions: ['read', 'create']
      },
      users_app_metadata: {
        actions: ['read', 'create']
      }
    }
  }
  </code></pre>
  
  <p>However since in adding claims we can only add simple string how something like this can be achieved ? </p>
  
  <p>The only way I have seen till now was to use JSON.serialization - coming from <a href="https://stackoverflow.com/a/27279400/2476347">https://stackoverflow.com/a/27279400/2476347</a></p>
  
  <pre><code>new Claim(someClass,JsonConvert.SerializeObject(result)
  </code></pre>
  
  <p>any guidelines would be much appreciated! Thanks!</p>
  
  <h1>Code used for testing</h1>
  
  <p>Class I would like to use in JWT</p>
  
  <pre><code>public class MyTes
  {
      public string       area { get; set; }
      public List&lt;string&gt; areapermissions { get; set; }
  }
  </code></pre>
  
  <p>And then I use the following code for token generation</p>
  
  <pre><code>        var identity = new ClaimsIdentity("JWT");
  
          var cos = new List&lt;string&gt;();
  
          cos.Add("aaa");
          cos.Add("bbb");
  
          MyTes vario = new MyTes()
          {
              area = "someregion",
              areapermissions = cos
          };
  
  
  
  
          identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
          identity.AddClaim(new Claim("sub", context.UserName));
          identity.AddClaim(new Claim(ClaimTypes.Role, "Manager"));
          identity.AddClaim(new Claim(ClaimTypes.Role, "Supervisor"));
          identity.AddClaim(new Claim("scope", "xyz1"));
          identity.AddClaim(new Claim("scope", "xyz2"));
          identity.AddClaim(new Claim("scope", "xyz3"));
          identity.AddClaim(new Claim("APIs", JsonConvert.SerializeObject(cos)));
          identity.AddClaim(new Claim("APIs2", JsonConvert.SerializeObject(vario)));
  </code></pre>
  
  <p>This gives no errors and when I decode the ticket I get now : </p>
  
  <pre><code>{
    "unique_name": "Rafski",
    "sub": "Rafski",
    "role": [
      "Manager",
      "Supervisor"
    ],
    "scope": [
      "xyz1",
      "xyz2",
      "xyz3"
    ],
    "APIs": "[\"aaa\",\"bbb\"]",
    "APIs2": "{\"area\":\"someregion\",\"areapermissions\":[\"aaa\",\"bbb\"]}",
    "iss": "http://kurwa.mac",
    "aud": "7aaa70ed8f0b4807a01596e2abfbd44d",
    "exp": 1429351056,
    "nbf": 1429349256
  }
  </code></pre>