title: IdentityServer4 is returning a valid token whether the userid and password combinations are valid or not
body: <p>I am writing an Angular4 application and I want to use a RestFul API with IdentityServer4 for authentication/authorization. To get the process started I downloaded the GitHub IdentityServer4Demo project. I made the demo work and decided to add a <strong>ResourceOwnerPasswordValidator</strong> and <strong>ProfileService</strong> services to authenticate the users who should have access to the application. My issue is that now all userid/password combinations triggers a valid token from IdentityServer <strong>whether the users are valid or not</strong>. What am I missing here?
  <a href="https://i.stack.imgur.com/4gFRf.png" rel="nofollow noreferrer">the userid and password should be alice to get an access token</a>
  Startup.cs</p>
  
  <pre><code>    public void ConfigureServices(IServiceCollection services)
      {
          services.AddMvc();
  
          var builder = services.AddIdentityServer()
              .AddInMemoryApiResources(Config.GetApis())
              .AddInMemoryIdentityResources(Config.GetIdentityResources())
              .AddInMemoryClients(Config.GetClients());
          //                .AddTestUsers(TestUsers.Users);
          services.AddTransient&lt;IProfileService, Configuration.ProfileService&gt;();
          services.AddTransient&lt;IResourceOwnerPasswordValidator, Configuration.ResourceOwnerPasswordValidator&gt;();
  
  
          // demo versions
          services.AddTransient&lt;IRedirectUriValidator, DemoRedirectValidator&gt;();
          services.AddTransient&lt;ICorsPolicyService, DemoCorsPolicy&gt;();
  
          if (_env.IsDevelopment())
          {
              builder.AddTemporarySigningCredential();
          }
          else
          {
              builder.AddTemporarySigningCredential();
              //builder.AddSigningCredential("6B7ACC520305BFDB4F7252DAEB2177CC091FAAE1", StoreLocation.CurrentUser, nameType: NameType.Thumbprint);
          }
      }
  </code></pre>
  
  <p>ResourceOwnerPasswordValidator.cs</p>
  
  <pre><code>      public Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
      {
          using (IDbConnection db = new SqlConnection("Data Source=server1;Initial Catalog=myDB;Integrated Security=SSPI;"))
          {
              var user = db.Query&lt;User&gt;("select * from Users where UserName=@UserName and Password=@Password",
                  new { UserName = context.UserName, Password = context.Password }).SingleOrDefault&lt;User&gt;();
              if (user == null)
              {
                  context.Result = new GrantValidationResult(IdentityModel.OidcConstants.TokenErrors.UnauthorizedClient, "Invalid User of Password.");
                  return Task.FromResult&lt;ResourceOwnerPasswordValidationContext&gt;(context);
              }
              else
              {
                  context.Result = new GrantValidationResult(user.Id.ToString(), "password");
                  return Task.FromResult&lt;ResourceOwnerPasswordValidationContext&gt;(context);
              }
  
          }
      }
  </code></pre>
  
  <p>ProfileService.cs</p>
  
  <pre><code>     public class ProfileService : IProfileService
  {
  
      public Task GetProfileDataAsync(ProfileDataRequestContext context)
      {
          context.IssuedClaims = context.Subject.Claims.ToList();
          //context.IssuedClaims.Add(new Claim("test-claim", "test-value"));
          return Task.FromResult(0);
      }
  
      public Task IsActiveAsync(IsActiveContext context)
      {
          return Task.FromResult(0);
      }
  }
  </code></pre>
  
  <p>Config.cs</p>
  
  <pre><code>     public static IEnumerable&lt;Client&gt; GetClients()
      {
          return new List&lt;Client&gt;
          {
              new Client
              {
                  ClientId = "client1",
                  RequireClientSecret = false,
                  //ClientSecrets = { new Secret("secret".Sha256()) },
                  //AccessTokenLifetime = 3600,
                  //AlwaysSendClientClaims=false,
                  AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
                  AllowedScopes = { "openid", "profile", "email", "api","api1"  },
                                      AllowOfflineAccess = true
              },
  </code></pre>