title: IdentityServer3: Some Claims not being returned from identity server
body: <p><strong>Context:</strong> 
  I am using ASP.NET MVC with OWIN self host. Below are the rest of the configs/setup.</p>
  
  <p>In my <strong>Client</strong>s in identity server (notice the <strong>AllowedScopes</strong> set):</p>
  
  <pre><code>public static class InMemoryClientSource
  {
      public static List&lt;Client&gt; GetClientList()
      {
          return new List&lt;Client&gt;()
          {
              new Client()
              {
                  ClientName = "Admin website",
                  ClientId = "admin",
                  Enabled = true,
                  Flow = Flows.Hybrid,
                  ClientSecrets = new List&lt;Secret&gt;()
                  {
                      new Secret("admin".Sha256())
                  },
                  RedirectUris = new List&lt;string&gt;()
                  {
                      "https://admin.localhost.com/"
                  },
                  PostLogoutRedirectUris = new List&lt;string&gt;()
                  {
                      "https://admin.localhost.com/"
                  },
                  AllowedScopes = new List&lt;string&gt; {
                      Constants.StandardScopes.OpenId,
                      Constants.StandardScopes.Profile,
                      Constants.StandardScopes.Email,
                      Constants.StandardScopes.Roles
                  }
              }
          };
      }
  }
  </code></pre>
  
  <p>Here are the <strong>Scopes</strong>:</p>
  
  <pre><code>public static class InMemoryScopeSource
  {
      public static List&lt;Scope&gt; GetScopeList()
      {
          var scopes = new List&lt;Scope&gt;();
  
          scopes.Add(StandardScopes.OpenId);
          scopes.Add(StandardScopes.Profile);
          scopes.Add(StandardScopes.Email);
          scopes.Add(StandardScopes.Roles);
  
          return scopes.ToList();
      }
  }
  </code></pre>
  
  <p>In the <strong>Identity Server</strong>, here's how the server is configured. (Notice the <strong>Clients</strong> and <strong>Scopes</strong> are the ones provided above) :</p>
  
  <pre><code>var userService = new UsersService( .... repository passed here .... );
  
          var factory = new IdentityServerServiceFactory()
              .UseInMemoryClients(InMemoryClientSource.GetClientList())
              .UseInMemoryScopes(InMemoryScopeSource.GetScopeList());
  
          factory.UserService = new Registration&lt;IUserService&gt;(resolver =&gt; userService);
  
          var options = new IdentityServerOptions()
          {
              Factory = factory,
              SigningCertificate = Certificates.Load(), // certificates blah blah
              SiteName = "Identity"
          };
  
          app.UseIdentityServer(options);
  </code></pre>
  
  <p>Finally, on the client web application side, this is how auth is set up:</p>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions()
          {
              AuthenticationType = "Cookies"
          });
  
          app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions()
          {
              Authority = "https://id.localhost.com",
              ClientId = "admin",
              RedirectUri = "https://admin.localhost.com/",
              PostLogoutRedirectUri = "https://admin.localhost.com/",
              ResponseType = "code id_token token",
              Scope = "openid profile email roles",
              ClientSecret = "admin",
              SignInAsAuthenticationType = "Cookies"
          });
  </code></pre>
  
  <p>I have implemented a custom class for IUserService:</p>
  
  <pre><code>public class UsersService : UserServiceBase
  {
      public UsersService( .... repository passed here .... )
      {
          //.... ctor stuff
      }
  
      public override Task AuthenticateLocalAsync(LocalAuthenticationContext context)
      {
          // var user = .... retrieved from database ..... 
          // ... auth logic ...
  
          if (isAuthenticated)
          {
              var claims = new List&lt;Claim&gt;();
              claims.Add(new Claim(Constants.ClaimTypes.GivenName, user.FirstName));
              claims.Add(new Claim(Constants.ClaimTypes.FamilyName, user.LastName));
              claims.Add(new Claim(Constants.ClaimTypes.Email, user.EmailAddress));
              context.AuthenticateResult = new AuthenticateResult(user.Id.ToString(), user.EmailAddress, claims);
          }
  
          return Task.FromResult(0);
      }
  }
  </code></pre>
  
  <p>As you see, the claims are passed in this line:</p>
  
  <pre><code>context.AuthenticateResult = new AuthenticateResult(user.Id.ToString(), user.EmailAddress, claims);
  </code></pre>
  
  <p>When I try logging in to IdentityServer3, I can log in successfully to the client web application. <strong>HOWEVER</strong>, when I get the user claims, I don't see any identity claims. No <strong>given_name</strong>, <strong>family_name</strong>, and <strong>email</strong> claims. Screenshot below:</p>
  
  <p><a href="https://i.stack.imgur.com/iq6wf.png" rel="noreferrer"><img src="https://i.stack.imgur.com/iq6wf.png" alt="As you can see, there are no given_name, family_name and email claims included."></a></p>
  
  <p>Anything I might have missed? Thanks in advance!</p>