title: Add tenant claim to access token using IdentityServer 4 based on acr value
body: <p>In my scenario a user can be linked to different tenants. A user should login in the context of a tenant. That means i would like the access token to contain a tenant claim type to restrict access to data of that tenant.</p>
  
  <p>When the client application tries to login i specify an acr value to indicate for which tenant to login. </p>
  
  <pre><code>          OnRedirectToIdentityProvider = redirectContext =&gt; {
              if (redirectContext.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication) {
                redirectContext.ProtocolMessage.AcrValues = "tenant:" + tenantId; // the acr value tenant:{value} is treated special by id4 and is made available in IIdentityServerInteractionService
              }
              return Task.CompletedTask;
            }
  </code></pre>
  
  <p>The value is received by my identity provider solution and is as well available in the <code>IIdentityServerInteractionService</code>.</p>
  
  <p><strong>The question is now, where can i add a claim to the access token for the requested tenant?</strong></p>
  
  <p><strong>IProfileService</strong></p>
  
  <p>In a IProfileService implementation the only point where acr values would be available is in the <code>IsActiveAsync</code> method when <code>context.Caller == AuthorizeEndpoint</code> in the HttpContext via IHttpContextAccessor. </p>
  
  <pre><code>String acr_values = _context.HttpContext.Request.Query["acr_values"].ToString();
  </code></pre>
  
  <p>But in <code>IsActiveAsync</code> i can not issue claims.
  In the <code>GetProfileDataAsync</code> calls the acr values are not available in the ProfileDataRequestContext nor in the HttpContext. Here i wanted to access acr values when 
  <code>context.Caller = IdentityServerConstants.ProfileDataCallers.ClaimsProviderAccessToken</code>. If i would have access i could issue the tenant claim.</p>
  
  <p>Further i analyzed <code>CustomTokenRequestValidator</code>, <code>IClaimsService</code> and <code>ITokenService</code> without success. It seems like the root problem is, that the token endpoint does not receive/process acr values. (event though <a href="http://docs.identityserver.io/en/3.1.0/endpoints/token.html" rel="nofollow noreferrer">here</a> acr is mentioned)</p>
  
  <p>I have a hard time figure this one out. Any help appreciated. Is it maybe completely wrong what i am trying? After figuring this one out i will have as well to understand how this affects access token refresh.</p>