How do you request an Identity Token (id_token) in IdentityServerr4

Question

I'm new to Identity Server and am confused on the topic of Identity & Access tokens. I understand access tokens are meant to secure resources (i.e. web api) and that identity tokens are used to authenticate. However, whenever I call /connect/token I always receive an "access_token". Within the request I've asked for a client which has various scopes and claims.

new Client
            {             
                ClientId = "Tetris",
                ClientName = "Tetris Web Api",
                AccessTokenLifetime = 60*60*24,
                AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
                RequireClientSecret = false,
                AllowedScopes = {"openid", "TetrisApi", "TetrisIdentity"}
            }



public static IEnumerable<ApiResource> GetApiResources()
        {
            return new[]
            {
                new ApiResource("TetrisApi", "Tetris Web API", new[] { JwtClaimTypes.Name, JwtClaimTypes.Role, "module" })
            };
        }

        public static IEnumerable<IdentityResource> GetIdentityResources()
        {
            return new List<IdentityResource>
            {
                new IdentityResources.OpenId(),
                new IdentityResources.Profile(),
                new IdentityResource
                {
                    Name = "TetrisIdentity",
                    UserClaims =
                        new[]
                        {
                            JwtClaimTypes.Name,
                            JwtClaimTypes.Role,
                            JwtClaimTypes.GivenName,
                            JwtClaimTypes.FamilyName,
                            JwtClaimTypes.Email,
                            "module",
                            "module.permissions"
                        }
                }
            };
        }

Below is a copy of postman:

Any thoughts? I didn't see an example in the Quickstarts that employs Identity Tokens.

Thanks!

leastprivilege leastprivilege · Accepted Answer · 2017-02-09T07:29:00

The password grant type does not support identity tokens. See RFC6749.

The best you can do here is to use the access token to get claims for the user using the userinfo endpoint.

The recommendation is to use an interactive flow like implicit or hybrid for end-user authentication.

How do you request an Identity Token (id_token) in IdentityServerr4

2 Answers