identityserver3 - How do I model Application specific Roles in Claims -

we have central usermanagerapplication manage users , roles multiple application. in application typically set

• usera in role admin application1
• usera in role reader application2

problem: when application2 request scope (say scopeapp1) includes roles, both reader , admin roles claim returned filtered on claimtypes , not scope.

question: how can request subset of roles?

we use custom userservice, , understanding place filter out returned claims in method, , cant find way figure out scope client requested:

public override task getprofiledataasync(profiledatarequestcontext context) 

as far can see options are:

• include applicationname included in role (app1admin, app2reader etc)
• create new claimtype each application. app1role, app2role
• i've missed obvious , need better understanding

thanks help

larsi

i pointed read @ https://github.com/identityserver/identityserver3/issues/474 describes problem.

in addition adding claims in customuserservice scopes not availible. when instead add claims in custom claimsprovider different signature

 public override async task<ienumerable<claim>> getaccesstokenclaimsasync(claimsprincipal subject, client client, ienumerable<scope> scopes, validatedrequest request) 

that lets me figure out requested scopes.