IdentityServer4 and UserInfo endpoint customization

3
votes

I have created an IdentityServer4 application, if I login inside that application the user claims are all good. If I login from another client application (MVC) the UserInfo endpoint doesn't return the same claims.

The IdentityServer is configured with ASP.NET Identity, so the UserProfile is already configured to return all UserClaims, like the one I created.

I don't understand why it's not showed on consent view or it's not included in UserInfo endpoint result

2
c#asp.net-coreopenididentityserver4
Some claims will only be returned if the appropriate scope is requested in the oidc request. – Vidmantas Blazevicius
I requested my custom scopes with the claims needed, I got them in the local principal but they're not returned by userinfo endpoint. – Matteo Bruni
You need to add more info, it's too hard to help you without understanding full problem – Vidmantas Blazevicius

2 Answers

6
votes

Please check for the below points if they can solve your issue

1.) Your Identity resource and API resource should have the required UserClaims.

2.) Check if there is some custom logic to issue requested claims for userinfo endpoint in your profile service.

public class ProfileService : IProfileService
{
    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        if (context.Caller == IdentityServerConstants.ProfileDataCallers.UserInfoEndpoint)
        { 
            //custom logic to add requested claims 
            context.AddRequestedClaims(claims);
        }
    }
}

3.) Try to make the property 'GetClaimsFromUserInfoEndpoint=true' in your MVC client AddOpenIdConnect configuration.

1
votes

have you configured your IdentityResources? Something like:

services.AddIdentityServer()

                .AddInMemoryIdentityResources(GetIdentityResources())

//where
public static List<IdentityResource> GetIdentityResources()
{
  // Claims automatically included in OpenId scope
  var openIdScope = new IdentityResources.OpenId();
  openIdScope.UserClaims.Add(JwtClaimTypes.Locale);

  // Available scopes
  return new List<IdentityResource>
  {
    openIdScope,
    new IdentityResources.Profile(),
    new IdentityResources.Email(),
    new IdentityResource(Constants.RolesScopeType, Constants.RolesScopeType,
      new List<string> {JwtClaimTypes.Role, Constants.TenantIdClaimType})
      {
        //when false (default), the user can deselect the scope on consent screen
        Required = true 
      }
  };
}