title: When using HttpClient with .AddClientAccessTokenHandler() extension, role claim is not included
body: <p>I am using <code>IdentityModel.AspNetCore</code> and <code>.AddClientAccessTokenHandler()</code> extension to automatically supply <code>HttpClient</code> with access token (at least that is what I understand I can use it for) to an API. Some API endpoints are authorized based on a role. But for some reason, the access token that is added to the request does not contain the role claim. If I do not use the <code>.AddClientAccessTokenHandler()</code> and manually retrieve the token and set it using <code>SetBearerToken(accessTone)</code> then I can reach my role authorized endpoint.</p>
  <p>My startup is:</p>
  <pre class="lang-cs prettyprint-override"><code>services.AddAccessTokenManagement(options =&gt;
  {
      options.Client.Clients.Add(&quot;auth&quot;, new ClientCredentialsTokenRequest
      {
          Address = &quot;https://localhost:44358/connect/token&quot;, 
          ClientId = &quot;clientId&quot;,
          ClientSecret = &quot;clientSecret&quot;,
      });
  });
  </code></pre>
  <p>WebApi call:</p>
  <pre class="lang-cs prettyprint-override"><code>var response = await _httpClient.GetAsync(&quot;api/WeatherForecast/SecretRole&quot;);
  </code></pre>
  <p>Identity server configuration:</p>
  <pre class="lang-cs prettyprint-override"><code>public static IEnumerable&lt;ApiResource&gt; GetApis() =&gt;
      new List&lt;ApiResource&gt;
      {
          new ApiResource(&quot;WebApi&quot;, new string[] { &quot;role&quot; })
              { Scopes = { &quot;WebApi.All&quot; }}
      };
  
  public static IEnumerable&lt;ApiScope&gt; GetApiScopes() =&gt;
      new List&lt;ApiScope&gt;
          { new ApiScope(&quot;WebApi.All&quot;) };
  
  public static IEnumerable&lt;IdentityResource&gt; GetIdentityResources() =&gt;
      new List&lt;IdentityResource&gt;
      {
          new IdentityResources.OpenId(),
          new IdentityResources.Profile(),
          new IdentityResource 
          {
              Name = &quot;roles&quot;,
              UserClaims = { &quot;role&quot; }
          }
      };
  
  public static IEnumerable&lt;Client&gt; GetClients() =&gt;
      new List&lt;Client&gt;
      {
          new Client
          {
              ClientId = &quot;clientId&quot;,
              ClientSecrets = { new Secret(&quot;clientSecret&quot;.ToSha256()) },
              AllowedGrantTypes = 
              { 
                  GrantType.AuthorizationCode, 
                  GrantType.ClientCredentials
              },
              AllowedScopes =
              {
                  &quot;WebApi.All&quot;,                        
                  IdentityServerConstants.StandardScopes.OpenId,
                  IdentityServerConstants.StandardScopes.Profile,
                  &quot;roles&quot;
              },
              RedirectUris = { &quot;https://localhost:44305/signin-oidc&quot; },
              PostLogoutRedirectUris  = { &quot;https://localhost:44305/Home/Index&quot; },
              AlwaysIncludeUserClaimsInIdToken = false,
              AllowOfflineAccess = true,
          }
      };
  </code></pre>
  <p>For testing purposes I add users manually from Program.cs</p>
  <pre><code>public static void Main(string[] args)
  {
      var host = CreateHostBuilder(args).Build();
      using (var scope = host.Services.CreateScope())
      {
          var userManager = scope.ServiceProvider.GetRequiredService&lt;UserManager&lt;IdentityUser&gt;&gt;();
          AddUsers(userManager).GetAwaiter().GetResult();
      }
      host.Run();
  }
  
  private static async Task AddUsers(UserManager&lt;IdentityUser&gt; userManager)
  {
      var adminClaim = new Claim(&quot;role&quot;, &quot;Admin&quot;);
      var visitorClaim = new Claim(&quot;role&quot;, &quot;Visitor&quot;);
  
      var user = new IdentityUser(&quot;Admin&quot;);
      await userManager.CreateAsync(user, user.UserName);
      await userManager.AddClaimAsync(user, adminClaim);
  
      user = new IdentityUser(&quot;Visitor&quot;);
      await userManager.CreateAsync(user, user.UserName);
      await userManager.AddClaimAsync(user, visitorClaim);
  }
  </code></pre>
  <p>So if I use manual access token retrieval and add it myself to the HttpClient headers, then my endpoint is reached and returns expected response. If I use <code>.AddClientAccessTokenHandler()</code>, I get 403 - Forbidden. What am I missing?</p>