title: How to put ASP.net Identity Roles into the Identityserver4 Identity token
body: <p>Although I am very happy that IdentityServer4 exists and makes life I with regards to authentication much easier in many ways, I've stumbled onto the problem and the many discussions of adding roles to claims within the community.</p>
  
  <p>My requirements are simple:</p>
  
  <ol>
  <li>I develop apps (xamarin forms) who require authentication and authorization</li>
  <li>I need a system to store the identity of my users (name, pwd, roles, phone…) -> ASP.net Identity</li>
  <li>I need a system to authenticate my users -> IdentityServer 4</li>
  <li>Roles per user are very limited (user/admin) and don’t change</li>
  <li>I need an API backend and an MVC admin site (asp.net core)</li>
  <li>I want to limit access to some API/MVC controllers using [Authorize(Roles = "Admin")]</li>
  </ol>
  
  <p>I've spent countless hours trying different configurations to get asp.net Identity roles to be passed to my MVC application after authentication but without luck. The purpose is as described in point 6.</p>
  
  <p>I've also spent countless hours reading but I have a feeling that the implementation IdentityServer4.AspIdentity regarding roles has changed a lot since the version v1.0.0. </p>
  
  <p>After reading a lot about this, it remains unclear how to actually implement this as it seems that some of the solution described only 2 months ago are no longer valid. </p>
  
  <p>So, for now I believe there are 2 paths:</p>
  
  <ol>
  <li>Role into the identity token by only requesting an identity token
  and using AlwaysIncludeInIdToken? </li>
  <li>Let the client retrieve the roles
  using the userinfo endpoint and somehow inject them into the
  httpcontext(?) alowing mvc to check using [Authorize(Roles =
  "Admin")]?</li>
  </ol>
  
  <p>Anyway, that's my assumptions.</p>
  
  <p>So, please help out and explain/document in detail so we can start implementing this in a durable way? Some workable examples would be great as well. </p>