title: IdentityServer4: How to return claims for current scope only
body: <p>I have a client that has access to 2 scopes from 2 different resources.  Each scope has it's own claims.  However, I'm noticing that ALL claims from both scopes are being returned to each resource.  How can I ensure that only claims related to correct scope are returned to the resource?</p>
  
  <p>Here's what I have in my Resource on Startup:</p>
  
  <pre><code>//I use IdentityServer3.AccessTokenRequest since my resource is a .net app
  
  public void Configuration(IAppBuilder app)
  {
      app.UseIdentityServerBearerTokenAuthentication(new identityServerBearerTokenAuthenticationOptions
      {
          Authority = URLToIdentityServer,
          RequiredScopes = new[] { "SomeAPI.read" } //Notice this is scope we want claims for.
      });  
  
      //Some other stuff
  }
  </code></pre>
  
  <p>And Here's what I have in identity server:</p>
  
  <pre><code>public static IEnumerable&lt;Client&gt; GetClients()
  {
          return new List&lt;Client&gt;
          {
              new Client
              {
                  ClientId = "ClientId",
                  ClientName = "Client Name",
                  ClientSecrets = new List&lt;Secret&gt; {new Secret("SuperSecret".Sha256())}, 
                  AllowedGrantTypes = GrantTypes.ClientCredentials,
                  AllowedScopes = new List&lt;string&gt; {"SomeAPI.read", "OtherAPI.write"},  //Notice client has access to 2 scopes from 2 resources.
                  Claims = claims
              }
          };
  }
  
  private static ICollection&lt;Claim&gt; claims = new List&lt;Claim&gt;
  {
          new Claim("Claim1", "Value1"), //Belongs to scope "SomeAPI.read"
          new Claim("Claim2", "Value2"), //Belongs to scope "SomeAPI.read"
          new Claim("Claim3", "Value3"), //Belongs to scope "OtherAPI.write"
          new Claim("Claim4", "Value4"), //Belongs to scope "OtherAPI.write"
  };
  </code></pre>
  
  <p>Just in case you're wondering how the resources &amp; scopes are declared:</p>
  
  <pre><code>public static IEnumerable&lt;ApiResource&gt; GetApiResources()
  {
          return new List&lt;ApiResource&gt;
          {
              new ApiResource
              {
                  Name = "SomeAPI",
                  DisplayName = "Some API",
                  Description = "This is the resource which we expect 2 claims for, but get 4",
                  ApiSecrets = new List&lt;Secret&gt; {new Secret("ScopeSecret".Sha256())},
                  Scopes = new List&lt;Scope&gt;
                  {
                      new Scope("SomeAPI.read", readClaimTypes),
                  },
                  Enabled = true,
              },
  
              new ApiResource
              {
                  Name = "OtherAPI",
                  DisplayName = "Other API",
                  Description = "Another API that also has a scope with 2 claims and we don't want to get these claims back in the resource they don't belong to",
                  ApiSecrets = new List&lt;Secret&gt; {new Secret("SomeOtherSecret".Sha256())},
                  Scopes = new List&lt;Scope&gt;
                  {
                          new Scope("OtherAPI.write", writeClaimTypes)
                  },
                  Enabled = true,
              }
          };
  }
  
  private static IEnumerable&lt;string&gt; readClaimTypes = new List&lt;string&gt; {"claim1", "claim2"};
  private static IEnumerable&lt;string&gt; writeClaimTypes = new List&lt;string&gt; {"claim3", "claim4"}; 
  }
  </code></pre>
  
  <p>With this configuration, I would expect my resource to only get the first 2 claims.  But it gets all 4.  Any help would be appreciated.</p>