authentication - ASP.NET Core 1.0. Bearer Token, cannot access custom claims -

i'm trying setup bearer authentication spa using asp.net core 1.0. i've got working jwttoken openidconnect server have issue custom claims not returned token.

my startup.cs logic authentication following:

private void configureauthentication(iapplicationbuilder app) {     app.usejwtbearerauthentication(options =>     {         options.automaticauthenticate = true;         options.authority = "http://localhost:53844";         options.audience = "http://localhost:53844";         options.requirehttpsmetadata = false;     });      app.useopenidconnectserver(options =>     {         options.tokenendpointpath = "/api/v1/token";         options.allowinsecurehttp = true;         options.authorizationendpointpath = pathstring.empty;         options.provider = new openidconnectserverprovider         {             onvalidateclientauthentication = context =>             {                 context.skipped();                 return task.fromresult<object>(null);             },             ongrantresourceownercredentials = async context =>             {                 var usersservice = app.applicationservices.getservice<iusersservice>();                  user user = usersservice.getuser(context.username, context.password);                  var identity = new claimsidentity(new list<claim>(), openidconnectserverdefaults.authenticationscheme);                 identity.addclaim(new claim(claimtypes.nameidentifier, user.id.tostring()));                 identity.addclaim(new claim(claimtypes.name, user.id.tostring()));                 identity.addclaim(new claim("myclaim", "4815162342"));                  var ticket = new authenticationticket(                     new claimsprincipal(identity),                     new authenticationproperties(),                     context.options.authenticationscheme);                  ticket.setresources(new[] { "http://localhost:53844" });                 ticket.setaudiences(new [] {"http://localhost:53844"});                 ticket.setscopes(new [] {"email", "offline_access" });                 context.validated(ticket);             }         };     }); } 

both access_token , refresh_token generating succesfully , when passing access_token in authorization header system treats request authorized.

the issue claims except nameidentifier not passed.

i use following code receive claims authenticated request:

public class webusercontext : iusercontext {     private readonly ihttpcontextaccessor contextaccessor;      public webusercontext(ihttpcontextaccessor contextaccessor)     {         this.contextaccessor = contextaccessor;     }      public long userid     {                 {             claimsidentity identity = principal?.identity claimsidentity;              if (identity == null)             {                 return -1;             }              claim claim = identity.claims.firstordefault(c => c.type == claimtypes.name); // there no such claim in claims collection             return long.parse(claim.value);         }     }      private claimsprincipal principal => contextaccessor.httpcontext.user claimsprincipal; } 

what can reason claims not passed or extracted token?

what can reason claims not passed or extracted token?

security.

unlike oauthauthorizationservermiddleware, asos doesn't assume access tokens consumed own resource servers (though agree it's common scenario) , refuses serialize claims don't explicitly specify "destination" avoid leaking confidential data unauthorized parties.

with jwt being default format in asos beta4 (but not in next beta), must keep in mind client applications (or users) can read access tokens.

for reason, must explicitly attach "destination" claims:

identity.addclaim(claimtypes.name, "pinpoint", destination: "id_token token"); 

specify id_token serialize claim in identity token, token serialize in access token or both serialize in both tokens (there's no equivalent authorization codes or refresh tokens encrypted , readable authorization server itself)