title: How to make IdentityServer to add user identity to the access token?
body: <p>Short: My client retrieves an access token from IdentityServer sample server, and then passes it to my WebApi. In my controller, this.HttpContext.User.GetUserId() returns null (User has other claims though). I suspect access token does not have nameidentity claim in it. How do I make IdentityServer include it?</p>
  
  <p>What I've tried so far:</p>
  
  <ul>
  <li>switched from hybrid to implicit flow (random attempt)</li>
  <li><p>in IdSvrHost scope definition I've added</p>
  
  <p>Claims = { new ScopeClaim(ClaimTypes.NameIdentifier, alwaysInclude: true) }</p></li>
  <li><p>in IdSvrHost client definition I've added</p>
  
  <p>Claims = { new Claim(ClaimTypes.NameIdentifier, "42") }</p></li>
  </ul>
  
  <p>(also a random attempt)</p>
  
  <p>I've also tried other scopes in scope definition, and neither of them appeared. It seems, that nameidentity is usually included in identity token, but for most public APIs I am aware of, you don't provide identity token to the server.</p>
  
  <p>More details:
  IdSrvHost and Api are on different hosts.
  Controller has [Authorize]. In fact, I can see other claims coming.
  Api is configured with</p>
  
  <pre><code>JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
  
  app.UseIdentityServerAuthentication(options =&gt; {
      options.Authority = "http://localhost:22530/";
  
      // TODO: how to use multiple optional scopes?
      options.ScopeName = "borrow.slave";
      options.AdditionalScopes = new[] { "borrow.receiver", "borrow.manager" };
  
      options.AutomaticAuthenticate = true;
      options.AutomaticChallenge = true;
  });
  </code></pre>
  
  <p>Scope:</p>
  
  <pre><code>public static Scope Slave { get; } = new Scope {
      Name = "borrow.slave",
      DisplayName = "List assigned tasks",
      Type = ScopeType.Resource,
  
      Claims = {
          new ScopeClaim(ClaimTypes.NameIdentifier, alwaysInclude: true),
      },
  };
  </code></pre>
  
  <p>And client:</p>
  
  <pre><code>new Client {
      ClientId = "borrow_node",
      ClientName = "Borrow Node",
  
      Flow = Flows.Implicit,
  
      RedirectUris = new List&lt;string&gt;
      {
          "borrow_node:redirect-target",
      },
  
      Claims = { new Claim(ClaimTypes.NameIdentifier, "42") },
  
      AllowedScopes = {
          StandardScopes.OpenId.Name,
          //StandardScopes.OfflineAccess.Name,
          BorrowScopes.Slave.Name,
      },
  }
  </code></pre>
  
  <p>Auth URI:</p>
  
  <pre><code>request.CreateAuthorizeUrl(
              clientId: "borrow_node",
              responseType: "token",
              scope: "borrow.slave",
              redirectUri: "borrow_node:redirect-target",
              state: state,
              nonce: nonce);
  </code></pre>
  
  <p>and I also tried</p>
  
  <pre><code>request.CreateAuthorizeUrl(
              clientId: "borrow_node",
              responseType: "id_token token",
              scope: "openid borrow.slave",
              redirectUri: "borrow_node:redirect-target",
              state: state,
              nonce: nonce);
  </code></pre>