title: IdentityServer4 appending client_ to claims
body: <p>I have an IdentityServer4 server setup and have defined a single client as such:</p>
  
  <pre><code>    public static IEnumerable&lt;Client&gt; Get()
      {
          return new List&lt;Client&gt; {
              new Client {
                  ClientId = "oauthClient",
                  ClientName = "Example Client Credentials Client Application",
                  AllowedGrantTypes = GrantTypes.ClientCredentials,
                  ClientSecrets = new List&lt;Secret&gt; {
                      new Secret("superSecretPassword".Sha256())},
                  AllowedScopes =     {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      IdentityServerConstants.StandardScopes.Email,
                      "role",
                      "ControlCenter",
                      "CC.Send",
                  },
                  Claims = new List&lt;System.Security.Claims.Claim&gt;
                  {
                      new System.Security.Claims.Claim("CEO","true"),
                      new System.Security.Claims.Claim(ClaimTypes.Role, "CC.Send"),
                      new System.Security.Claims.Claim(ClaimTypes.Role, "CEO")
                  },
                  RedirectUris = new List&lt;string&gt; {"https://localhost:44345/signin-oidc", "https://www.getpostman.com/oauth2/callback"},
                  PostLogoutRedirectUris = new List&lt;string&gt; {"https://localhost:44345"}
              }
          };
      }
  </code></pre>
  
  <p>I am using postman to test this and I can get a Token at the /connect/token endpoint, but when I pass that token into the /connect/introspect endpoint it is returning:</p>
  
  <pre><code>{
      "nbf": 1505422619,
      "exp": 1505426219,
      "iss": "https://localhost:44357",
      "aud": [
          "https://localhost:44357/resources",
          "ControlCenter"
      ],
      "client_id": "oauthClient",
      "client_CEO": "true",
      "client_http://schemas.microsoft.com/ws/2008/06/identity/claims/role": [
          "CC.Send",
          "CEO"
      ],
      "scope": "CC.Send",
      "active": true
  }
  </code></pre>
  
  <p>This was causing me trouble as I had secured my endpoint with:</p>
  
  <pre><code>        services.AddAuthorization(options =&gt;
          {
              options.AddPolicy(
                  "CanSendiSuiteProfiles",
                  policyBuilder =&gt; policyBuilder.RequireClaim("CEO", "true"));
          });
  </code></pre>
  
  <p>and due to the CEO &lt;> client_CEO, it was returning an error 403. I can get around this pretty simply by looking for client_CEO but I would prefer to understand how client_ is being prepended to my claim.</p>