title: ADFS 2016 On behalf of flow : cannot get any user informations
body: <p>I'm trying to implement the &quot;on behalf of&quot; flow in an application using ADFS 2016 as STS. As a reference, I look at this Microsoft tutorial (<a href="https://docs.microsoft.com/en-ca/windows-server/identity/ad-fs/development/ad-fs-on-behalf-of-authentication-in-windows-server" rel="nofollow noreferrer">https://docs.microsoft.com/en-ca/windows-server/identity/ad-fs/development/ad-fs-on-behalf-of-authentication-in-windows-server</a>). It's working as it should, I can login into my web application and then use my original access token in UserAssertion to generate a new access token with the proper audience to call my API BUT I found absolutely no way to include any user informations (sub, name, email, upn etc.) into the access token for my API, even if I set claim rules into my ADFS configurations for the API.</p>
  <p>I checked the communication between my app and adfs using Fiddler and everything looks like the  informations in the tutorial. See the screen shot of the &quot;on behalf of&quot; request below :</p>
  <p><a href="https://i.stack.imgur.com/1aK86.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1aK86.png" alt="enter image description here" /></a></p>
  <p>Here's the resulting access token :</p>
  <p><a href="https://i.stack.imgur.com/EIk1q.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EIk1q.png" alt="enter image description here" /></a></p>
  <p>Finally, here's the code I use to generate my new access token :</p>
  <pre><code>private async Task&lt;string&gt; GetAccessToken(ClaimsPrincipal user, string originalAccessToken)
  {
      var authority = &quot;[authority]&quot;;
      var context = new AuthenticationContext(authority, false);
      string userName = user.FindFirstValue(&quot;upn&quot;);
      var userAssertion = new UserAssertion(originalAccessToken, &quot;urn:ietf:params:oauth:grant-type:jwt-bearer&quot;,userName);
      var cc = new ClientCredential(&quot;https://localhost:44387/&quot;, &quot;[client_secret]&quot;);
  
      var result = await context.AcquireTokenAsync(&quot;https://localhost:44339/&quot;, cc, userAssertion);
  
      return result.AccessToken;
  }
  </code></pre>
  <p>Have you struggle with that scenario and if yes, did you find a way to fix this ?</p>
  <p>Thanks</p>