title: dotnetopenauth - How to add extra data in the refresh token?
body: <p>I'm currently working on a project where an iPad application requires access to an existing web application. The iPad application has been developed internally and is therefore a trusted application. However the data provided by the web application is sensitive so we don't want to store client credentials on the iPad. We also want the ability to revoke iPad access without affecting regular user access.</p>
  
  <p>Given the above, the OAuth2 Resource Owner Password Credentials grant/flow was a good fit for our requirements which we've implemented with DotNetOpenAuth since its an established library.</p>
  
  <p>However, we now require some metadata to be added to the access and refresh tokens for the resource server. The authorization server is adding the metadata via the AuthorizationServerAccessToken.ExtraData property in our implementation of the IAuthorizationServerHost.CreateAccessToken method:</p>
  
  <pre><code>public AccessTokenResult CreateAccessToken(IAccessTokenRequest accessTokenRequestMessage)
  {
      var accessToken = new AuthorizationServerAccessToken();
  
      // Add some extra data to access token
      accessToken.ExtraData.Add("server_parameter1", this.ServerValue1);
      accessToken.ExtraData.Add("server_parameter2", this.ServerValue2);
  
      // Set ResourceServerEncryptionKey properties etc
  
      return new AccessTokenResult(accessToken);
  }
  </code></pre>
  
  <p>This does exactly what we want for the access token however the same "ExtraData" is not included in the refresh token which causes an issue when the access token expires and needs to be refreshed because we effectively lose the additional data (since the old access token is discarded).</p>
  
  <p>Can anyone advise if its possible to populate the refresh tokens "ExtraData" in the current version of DotNetOpenAuth in a similar way to the access token?</p>