title: Configuring Identity Server to use ASP.NET Identity roles
body: <p>I am trying to learn more about Identity Server.  I am currently struggling to get Role Based Authorisation working.  Here are the steps I have followed:</p>
  
  <p>1) Download the sample solution: <a href="https://github.com/IdentityServer/IdentityServer4.Samples/tree/release/Quickstarts/6_AspNetIdentity" rel="nofollow noreferrer">https://github.com/IdentityServer/IdentityServer4.Samples/tree/release/Quickstarts/6_AspNetIdentity</a></p>
  
  <p>2) Run the solution, which starts:</p>
  
  <p>a) Identity Server project</p>
  
  <p>b) MVC project</p>
  
  <p>c) API project</p>
  
  <p>3) Browse to the MVC project and apply migrations.
  4) Register a new user: Bert@Bert.com
  5) Browse to: CallApiUsingUserAccessToken in the MVC project.  The API is reached as expected because the user is authorised.</p>
  
  <p>Say I now wanted to change IdentityContoller from this:</p>
  
  <pre><code>[Authorize] 
  public class IdentityController : ControllerBase 
  </code></pre>
  
  <p>to this:</p>
  
  <pre><code>[Authorize(Roles="Admin")] 
  public class IdentityController : ControllerBase 
  </code></pre>
  
  <p>and Home Controller (<a href="https://github.com/IdentityServer/IdentityServer4.Samples/blob/release/Quickstarts/6_AspNetIdentity/src/MvcClient/Controllers/HomeController.cs" rel="nofollow noreferrer">https://github.com/IdentityServer/IdentityServer4.Samples/blob/release/Quickstarts/6_AspNetIdentity/src/MvcClient/Controllers/HomeController.cs</a>) from this:</p>
  
  <pre><code>public async Task&lt;IActionResult&gt; CallApiUsingUserAccessToken()
  </code></pre>
  
  <p>to this:</p>
  
  <pre><code>[Authorize(Roles="Admin")] 
  public async Task&lt;IActionResult&gt; CallApiUsingUserAccessToken()
  </code></pre>
  
  <p>What changes would I have to make to the configuration? </p>
  
  <p>I have tried a few suggestions this afternoon.  For example, in the startup of the MVCClient I tried adding:</p>
  
  <pre><code>options.ClaimActions.MapJsonKey("role", "role", "role");
  options.TokenValidationParameters.NameClaimType = "name";
  options.TokenValidationParameters.RoleClaimType = "role";
  </code></pre>
  
  <p>Please assume that I have correctly added the roles to the identity database (and associated the roles with the users).</p>