title: Getting access token claims in claims principal in IdentityServer4
body: <p>I'm trying to get my head around oAuth2/IdentityServer4.  </p>
  
  <p>Using the sample application at<br>
  <a href="https://github.com/IdentityServer/IdentityServer4.Samples/tree/dev/Quickstarts/3_ImplicitFlowAuthentication" rel="nofollow noreferrer">https://github.com/IdentityServer/IdentityServer4.Samples/tree/dev/Quickstarts/3_ImplicitFlowAuthentication</a></p>
  
  <p>The following code in the MVC application:</p>
  
  <pre><code> @foreach (var claim in User.Claims)
      {
          &lt;dt&gt;@claim.Type&lt;/dt&gt;
          &lt;dd&gt;@claim.Value&lt;/dd&gt;
      }
  </code></pre>
  
  <p>Returns what appears to be identity token claims</p>
  
  <p><strong>nbf</strong><br>
  1467173142<br>
  <strong>exp</strong><br>
  1467173442<br>
  <strong>iss</strong><br>
  <a href="http://localhost:5000" rel="nofollow noreferrer">http://localhost:5000</a><br>
  <strong>aud</strong><br>
  mvc<br>
  <strong><em>nonce</em></strong><br>
  636027699106782287.MDI0YzI5MTQtYmQxNy00MDllLWJmYzQtZjBhYzI2MGNjYmE3MDFmNzg1YmUtM2Y5ZC00YjBiLWEzOGItN2Q3ODRiODJlYjFl<br>
  <strong>iat</strong><br>
  1467173142<br>
  <strong>c_hash</strong><br>
  H2i5QeJKlHM5-s8vUTYlOw<br>
  <strong>sid</strong><br>
  42b58d38e2b7c6cc653492742a08840b<br>
  <strong>sub</strong><br>
  818727<br>
  <strong>auth_time</strong><br>
  1467170555<br>
  <strong>idp</strong><br>
  idsvr<br>
  <strong>name</strong><br>
  Alice Smith<br>
  <strong>given_name</strong><br>
  Alice<br>
  <strong>family_name</strong><br>
  Smith<br>
  <strong>website</strong><br>
  <a href="http://alice.com" rel="nofollow noreferrer">http://alice.com</a><br>
  <strong>amr</strong><br>
  pwd  </p>
  
  <p>The following code in the API project</p>
  
  <pre><code> var claims = User.Claims.Select(c =&gt; new { c.Type, c.Value });
   return new JsonResult(claims);
  </code></pre>
  
  <p>Returns what appears to be access token claims</p>
  
  <pre><code>{
     "Type": "nbf",
     "Value": "1467173142"
  },
  {
     "Type": "exp",
     "Value": "1467176742"
  },
  {
     "Type": "iss",
     "Value": "http://localhost:5000"
  },
  {
     "Type": "aud",
     "Value": "http://localhost:5000/resources"
  },
  {
     "Type": "client_id",
     "Value": "mvc"
  },
  {
     "Type": "scope",
     "Value": "openid"
  },
  {
     "Type": "scope",
     "Value": "profile"
  },
  {
     "Type": "scope",
    "Value": "api1"
  },
  {
     "Type": "sub",
     "Value": "818727"
  },
  {
     "Type": "auth_time",
     "Value": "1467170555"
  },
  {
     "Type": "idp",
     "Value": "idsvr"
  }
  </code></pre>
  
  <p>Notice the code is essentially the same (return claims in the user identity principle) and lack of name/email but the inclusion of scope claims in the API example.</p>
  
  <p>The token flow is essentially IdentityServer4 => MVC Project => API Project. Obviously the MVC project has both the identityToken and access token but it's not load the access token int User.Claims.</p>
  
  <p>My goal is to have the scope claims available in User in the MVC project so that I can setup policies to work the Authorize attribute section off my MVC methods.</p>
  
  <p>Startup for the API project is here: <a href="https://github.com/IdentityServer/IdentityServer4.Samples/blob/dev/Quickstarts/3_ImplicitFlowAuthentication/src/Api/Startup.cs" rel="nofollow noreferrer">https://github.com/IdentityServer/IdentityServer4.Samples/blob/dev/Quickstarts/3_ImplicitFlowAuthentication/src/Api/Startup.cs</a></p>
  
  <p>Startup for the MVC project is here:
  <a href="https://github.com/IdentityServer/IdentityServer4.Samples/blob/dev/Quickstarts/3_ImplicitFlowAuthentication/src/Api/Startup.cs" rel="nofollow noreferrer">https://github.com/IdentityServer/IdentityServer4.Samples/blob/dev/Quickstarts/3_ImplicitFlowAuthentication/src/Api/Startup.cs</a></p>
  
  <p>Thanks,
  dave</p>