title: IdentityServer - Using Hybrid Flow
body: <p>I implemented an IdentityServer3 and try to use it with my new ASP.NET Core MVC application. </p>
  
  <p>I want to use the Hybrid Flow but I don't seem to get it working.</p>
  
  <p>My client on the IdentityServer3 is setup like this:</p>
  
  <pre><code>new Client
  {
      ClientName = "Test",
      ClientId = "Test",
      ClientUri = "http://localhost:59528/",
      Flow = Flows.Hybrid,
      AllowedScopes = new List&lt;string&gt;()
      {
          Constants.StandardScopes.OpenId,
          Constants.StandardScopes.Profile
      },
      RedirectUris = new List&lt;string&gt;
      {
          "http://localhost:59528/signin-oidc",
      },
      PostLogoutRedirectUris = new List&lt;string&gt;
      {
          "http://localhost:59528/",
      },
      Enabled = true
  }
  </code></pre>
  
  <p>ASP.NET Core MVC application it is setup like this:</p>
  
  <pre><code>public void Configure(IApplicationBuilder app, ILoggerFactory loggerFactory, IConfigurationService configurationService, ApplicationDbContextSeedData seeder)
  {
      JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
  
      /* Logging Configuration */
      loggerFactory.AddConsole();
      if (_environment.IsDevelopment())
      {
          app.UseDeveloperExceptionPage();
          loggerFactory.AddDebug(LogLevel.Information);
      }
      else
      {
          loggerFactory.AddDebug(LogLevel.Error);
      }
  
      /* Identity Server Configuration */
      app.UseCookieAuthentication(new CookieAuthenticationOptions
      {
          AuthenticationScheme = "Cookies",
          AutomaticAuthenticate = true
      });
      app.UseOpenIdConnectAuthentication(configurationService.GetOpenIdConnectOptions());
  
      /* MVC Route Configuration */
      app.UseStaticFiles();
      app.UseMvc(ConfigureRoutes);
  
      /* Database Configuration */
      seeder.EnsureSeedData().Wait();
  }
  </code></pre>
  
  <p>Here are the options that I read in the <em>GetOpenIdConnectOption</em> method:</p>
  
  <pre><code>"OpenIdConnectOptions": {
      "AuthenticationScheme": "oidc",
      "SignInScheme": "Cookies",
      "Authority": "http://localhost:7506/",
      "RequireHttpsMetadata": "false",
      "PostLogoutRedirectUri": "http://localhost:59528/",
      "ClientId": "Test",
      "ResponseType": "code id_token token",
      "GetClaimsFromUserInfoEndpoint": "true",
      "SaveTokens": "true",
      "Scopes": [ "openid", "profile" ]
  }
  </code></pre>
  
  <p>With this setup I get redirected to the IdentityServer, I can login and after I allow my application I get redirected to an error page on my  ASP.NET Core MVC application with the following error:</p>
  
  <pre><code>http://localhost:59528/signin-oidc
  HttpRequestException: Response status code does not indicate success: 400 (Bad Request).
  </code></pre>
  
  <p>If I change some settings (add ClientSecret to Server and Client and change the flow) I managed to get it working with the Implicit Flow but I would prefer the Hybrid flow.</p>
  
  <p>Does somebody have an idea what I'm doing wrong?</p>
  
  <p><strong>Edit:</strong> 
  I changed some things (added secrets to client and server) and now I get the following log from the IdentityServer3. It seems everything is okay there.</p>
  
  <pre><code>2016-08-29 06:49:44,791 [18] INFO  IdentityServer3.Core.Endpoints.AuthorizeEndpointController Resuming from consent, restarting validation
  2016-08-29 06:49:44,792 [18] INFO  IdentityServer3.Core.Validation.AuthorizeRequestValidator Start authorize request protocol validation
  2016-08-29 06:49:44,805 [25] INFO  IdentityServer3.Core.Validation.AuthorizeRequestValidator Authorize request validation success
   {
    "ClientId": "Test",
    "ClientName": "Test",
    "RedirectUri": "http://localhost:59528/signin-oidc",
    "AllowedRedirectUris": [
      "http://localhost:59528/signin-oidc"
    ],
    "SubjectId": "...",
    "ResponseType": "code id_token token",
    "ResponseMode": "form_post",
    "Flow": "Hybrid",
    "RequestedScopes": "openid profile email",
    "State": "...",
    "Nonce": "...",
    "SessionId": "...",
    "Raw": {
      "client_id": "Test",
      "redirect_uri": "http://localhost:59528/signin-oidc",
      "response_type": "code token id_token",
      "scope": "openid profile email",
      "response_mode": "form_post",
      "nonce": "...",
      "state": "..."
      }
  }
  2016-08-29 06:49:44,808 [20] INFO  IdentityServer3.Core.ResponseHandling.AuthorizeResponseGenerator Creating Hybrid Flow response.
  2016-08-29 06:49:44,812 [15] INFO  IdentityServer3.Core.ResponseHandling.AuthorizeResponseGenerator Creating Implicit Flow response.
  2016-08-29 06:49:44,813 [15] DEBUG IdentityServer3.Core.Services.Default.DefaultTokenService Creating access token
  2016-08-29 06:49:44,814 [15] DEBUG IdentityServer3.Core.Services.Default.DefaultTokenService Creating JWT access token
  2016-08-29 06:49:44,865 [15] DEBUG IdentityServer3.Core.Services.Default.DefaultTokenService Creating identity token
  2016-08-29 06:49:44,866 [15] INFO  IdentityServer3.Core.Services.Default.DefaultClaimsProvider Getting claims for identity token for subject: 88010bab-091e-4095-8f5d-ac89a3fd9198
  2016-08-29 06:49:44,920 [10] INFO  IdentityServer3.EntityFramework.TokenCleanup Clearing tokens
  2016-08-29 06:49:44,983 [15] DEBUG IdentityServer3.Core.Services.Default.DefaultTokenService Creating JWT identity token
  2016-08-29 06:49:45,035 [15] DEBUG IdentityServer3.Core.Endpoints.AuthorizeEndpointController Adding client virtualmoney to client list cookie for subject 88010bab-091e-4095-8f5d-ac89a3fd9198
  2016-08-29 06:49:45,037 [15] INFO  IdentityServer3.Core.Results.AuthorizeFormPostResult Posting to http://localhost:59528/signin-oidc
  2016-08-29 06:49:45,038 [15] DEBUG IdentityServer3.Core.Results.AuthorizeFormPostResult Using DefaultViewService to render authorization response HTML
  2016-08-29 06:49:45,179 [18] INFO  IdentityServer3.Core.Endpoints.TokenEndpointController Start token request
  2016-08-29 06:49:45,180 [18] DEBUG IdentityServer3.Core.Validation.ClientSecretValidator Start client validation
  2016-08-29 06:49:45,181 [18] DEBUG IdentityServer3.Core.Validation.BasicAuthenticationSecretParser Start parsing Basic Authentication secret
  2016-08-29 06:49:45,182 [18] DEBUG IdentityServer3.Core.Validation.PostBodySecretParser Start parsing for secret in post body
  2016-08-29 06:49:45,183 [18] DEBUG IdentityServer3.Core.Validation.SecretParser Parser found secret: PostBodySecretParser
  2016-08-29 06:49:45,184 [18] INFO  IdentityServer3.Core.Validation.SecretParser Secret id found: virtualmoney
  2016-08-29 06:49:45,188 [24] DEBUG IdentityServer3.Core.Validation.SecretValidator Secret validator success: HashedSharedSecretValidator
  2016-08-29 06:49:45,189 [24] INFO  IdentityServer3.Core.Validation.ClientSecretValidator Client validation success
  2016-08-29 06:49:45,190 [24] INFO  IdentityServer3.Core.Validation.TokenRequestValidator Start token request validation
  2016-08-29 06:49:45,191 [24] INFO  IdentityServer3.Core.Validation.TokenRequestValidator Start validation of authorization code token request
  2016-08-29 06:49:45,218 [22] INFO  IdentityServer3.Core.Validation.TokenRequestValidator Validation of authorization code token request success
  2016-08-29 06:49:45,220 [22] INFO  IdentityServer3.Core.Validation.TokenRequestValidator Token request validation success
   {
    "ClientId": "Test",
    "ClientName": "Test",
    "GrantType": "authorization_code",
    "AuthorizationCode": "...",
    "Raw": {
      "client_id": "Test",
      "client_secret": "******",
      "code": "...",
      "grant_type": "authorization_code",
      "redirect_uri": "http://localhost:59528/signin-oidc"
    }
  }
  2016-08-29 06:49:45,221 [22] INFO  IdentityServer3.Core.ResponseHandling.TokenResponseGenerator Creating token response
  2016-08-29 06:49:45,223 [22] INFO  IdentityServer3.Core.ResponseHandling.TokenResponseGenerator Processing authorization code request
  2016-08-29 06:49:45,225 [22] DEBUG IdentityServer3.Core.Services.Default.DefaultTokenService Creating access token
  2016-08-29 06:49:45,227 [22] DEBUG IdentityServer3.Core.Services.Default.DefaultTokenService Creating JWT access token
  2016-08-29 06:49:45,300 [22] DEBUG IdentityServer3.Core.Services.Default.DefaultTokenService Creating identity token
  2016-08-29 06:49:45,302 [22] INFO  IdentityServer3.Core.Services.Default.DefaultClaimsProvider Getting claims for identity token for subject: 88010bab-091e-4095-8f5d-ac89a3fd9198
  2016-08-29 06:49:45,405 [22] DEBUG IdentityServer3.Core.Services.Default.DefaultTokenService Creating JWT identity token
  2016-08-29 06:49:45,486 [22] INFO  IdentityServer3.Core.Endpoints.TokenEndpointController End token request
  </code></pre>
  
  <p>But now I get this error on my client after the redirect from the IdentityServer3:</p>
  
  <pre><code>OpenIdConnectProtocolException: IDX10300: The hash claim: '...' in the id_token did not validate with against
  </code></pre>