Identityserver4: what is the benefit of adding UserClaims 'role' to IdentityResource

Created on 8 Nov 2017 · 9Comments · Source: IdentityServer/IdentityServer4

Hello,

why we add , or what the benefit of adding UserClaims 'role' to IdentityResource

new IdentityResource { Name = "role", UserClaims = new List<string> {"role"} }

it's not add the roles to the token

i can only add the roles to token by adding UserClaims 'role' to ApiResource

when i remove UserClaims 'role' from IdentityResource my project also work fine.

question

Source

BahgatMashaly

Most helpful comment

IdentityResource controls what goes in the id token to the client. ApiResource controls what goes into the access token for the API.

brockallen on 9 Nov 2017

👍3

All 9 comments

IdentityResource controls what goes in the id token to the client. ApiResource controls what goes into the access token for the API.

brockallen on 9 Nov 2017

👍3

thanks dear @brockallen , but i think this is different from the documents, or i'm not understanding something .

the documentation:
"Identity resources are data like user ID, name, or email address of a user. An identity resource has a unique name, and you can assign arbitrary claim types to it. # These claims will then be included in the identity token for the user. The client will use the scope parameter to request access to an identity resource."

also if i add custom claims to IdentityResource it will inject it into user token ,
but when add 'role' claim to IdentityResource it will NOT inject it to user token
, only if i add 'role' claim to ApiResource then it will be inject role to user token

Example:
if i have 'administrator' and 'user' roles in the database , i must add these roles to ApiResource not IdentityResource to inject it to user token to be like this:

{
"nbf": 1510214356,
"exp": 1510215256,
"iss": "http://localhost:5000",
"aud": [
"http://localhost:5000/resources",
"WebAPI"
],
"client_id": "AngularSPA",
"sub": "33af17bf-eb84-4e27-a67e-defccef15874",
"auth_time": 1510214356,
"idp": "local",
"role": [
"administrator",
"user"
],
"my_claim_type": "my_claim_value",
"scope": [
"address",
"custom_profile_claim",
"myroles",
"openid",
"profile",
"roles",
"WebAPI.Write",
"offline_access"
],
"amr": [
"pwd"
]
}

BahgatMashaly on 9 Nov 2017

user token

What's a user token?

brockallen on 9 Nov 2017

the user token is the token that user gets after authentication succeeded
example:
{
"nbf": 1510214356,
"exp": 1510215256,
"iss": "http://localhost:5000",
"aud": [
"http://localhost:5000/resources",
"WebAPI"
],
"client_id": "AngularSPA",
"sub": "33af17bf-eb84-4e27-a67e-defccef15874",
"auth_time": 1510214356,
"idp": "local",
"role": [
"administrator",
"user"
],
"my_claim_type": "my_claim_value",
"scope": [
"address",
"custom_profile_claim",
"myroles",
"openid",
"profile",
"roles",
"WebAPI.Write",
"offline_access"
],
"amr": [
"pwd"
]
}