title: Getting Claims from Google in ASP.Net Core 2.1 using OpenIdDict
body: <p>I'm having some trouble getting claims from Google in a ASP.Net Core 2.1 Web API using OpenIdDict.</p>
  
  <p>I've selected "No Authentication" in ASP.Net MVC template since I have no interest in storing usernames / passwords myself. I will be relying on external providers (such as Google) for authentication. The client is a SPA, so I'm using Implicit Flow.</p>
  
  <p>My code is based on following this tutorial (except using Google rather than GitHub):
  <a href="https://www.jerriepelser.com/blog/implementing-openiddict-authorization-server-part-2/" rel="nofollow noreferrer">https://www.jerriepelser.com/blog/implementing-openiddict-authorization-server-part-2/</a></p>
  
  <p>A Token is being returned from Google - but when I examine the JWT it does not contain any claims information.
  What am I missing?</p>
  
  <p>My Startup.cs looks like:</p>
  
  <pre><code>public class Startup
  {
      public Startup(IConfiguration configuration)
      {
          Configuration = configuration;
      }
  
      public IConfiguration Configuration { get; }
  
      // This method gets called by the runtime. Use this method to add services to the container.
      public void ConfigureServices(IServiceCollection services)
      {
  
          // Register OpenIdDict database (EF Core)
          services.AddDbContext&lt;PD.Server.DataAccess.AuthorizationDbContext&gt;(o =&gt; 
              { 
                  o.UseSqlServer(Configuration.GetConnectionString("AuthorizationDbContext"));
                  o.UseOpenIddict();
              });
  
          // Authentication
          services.AddAuthentication(auth =&gt;
          {
              auth.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
              auth.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
              auth.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
          }).AddCookie()
          .AddGoogle(o =&gt;
          {
              o.ClientId = Configuration["Authentication:Google:ClientId";
              o.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
              o.CallbackPath = "/signin-google";
          });
  
          services.AddOpenIddict()
          .AddCore(o =&gt; o.UseEntityFrameworkCore().UseDbContext&lt;AuthorizationDbContext&gt;() )
          .AddServer(o =&gt;
          {
              o.UseMvc();                                                                 // Register MVC Binder
              o.EnableAuthorizationEndpoint("/connect/authorize")
               .EnableLogoutEndpoint("/connect/logout");                                  // Enable the Authorization end-point
  
              o.RegisterScopes(OpenIddictConstants.Scopes.Email, 
                               OpenIddictConstants.Scopes.Profile,
                               OpenIddictConstants.Scopes.Roles);
  
              o.AllowImplicitFlow();                                                      // Enable Implicit Flow (i.e. OAuth2 authentication for SPA's)
  
              o.EnableRequestCaching();
  
              o.DisableHttpsRequirement();                                                // DEV ONLY!
              o.AddEphemeralSigningKey();                                                 // DEV ONLY!
  
          })
          .AddValidation();
  
          // Cors
          services.AddCors();
  
          services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
      }
  
  
      public void Configure(IApplicationBuilder app, IHostingEnvironment env)
      {
          app.UseCors(builder =&gt;
          {
              builder.WithOrigins("https://localhost:5001");
              builder.WithMethods("GET");
              builder.WithHeaders("Authorization");
          });
  
          app.UseAuthentication();
          app.UseMvcWithDefaultRoute();
          app.MigrateDatabase();
  
          // Configure the OpenIdDict Database (not shown)
          InitializeAsync(app.ApplicationServices, CancellationToken.None).GetAwaiter().GetResult();
      }
  </code></pre>
  
  <p>And my Authenticate method:</p>
  
  <pre><code>    [HttpGet("~/connect/authorize")]
      public IActionResult Authorize(OpenIdConnectRequest request)
      {
          if (!User.Identity.IsAuthenticated) return Challenge("Google");
  
          var claims = new List&lt;Claim&gt;();
          claims.Add(new Claim(OpenIdConnectConstants.Claims.Subject, User.FindFirstValue(ClaimTypes.NameIdentifier), OpenIdConnectConstants.Destinations.IdentityToken));
          claims.Add(new Claim(OpenIdConnectConstants.Claims.Name, User.FindFirstValue(ClaimTypes.Name), OpenIdConnectConstants.Destinations.IdentityToken));
          claims.Add(new Claim(OpenIdConnectConstants.Claims.Email, User.FindFirstValue(ClaimTypes.Email), OpenIdConnectConstants.Destinations.IdentityToken));
          claims.Add(new Claim(OpenIdConnectConstants.Claims.EmailVerified, "true", OpenIdConnectConstants.Destinations.IdentityToken));
          var identity = new ClaimsIdentity(claims, "OpenIddict");            
          var principle = new ClaimsPrincipal(identity);
  
          // Create a new Authentication Ticket
          var ticket = new AuthenticationTicket(principle, new AuthenticationProperties(), OpenIdConnectServerDefaults.AuthenticationScheme);
  
          return SignIn(ticket.Principal, ticket.Properties, ticket.AuthenticationScheme);
      }
  </code></pre>
  
  <p>Thanks in advance.</p>