title: How to add claims to access token get from IdentityServer3 using resource owner flow with javascript client
body: <p>I use the resource owner flow with IdentityServer3 and send get token request to identity server token endpoint with username and password in javascript as below:</p>
  
  <pre><code>        function getToken() {
          var uid = document.getElementById("username").value;
          var pwd = document.getElementById("password").value;
          var xhr = new XMLHttpRequest();
          xhr.onload = function (e) {
              console.log(xhr.status);
              console.log(xhr.response);
              var response_data = JSON.parse(xhr.response);
              if (xhr.status === 200 &amp;&amp; response_data.access_token) {
                  getUserInfo(response_data.access_token);
                  getValue(response_data.access_token);
              }
          }
          xhr.open("POST", tokenUrl);
          var data = {
              username: uid,
              password: pwd,
              grant_type: "password",
              scope: "openid profile roles",
              client_id: 'client_id'
          };
          var body = "";
          for (var key in data) {
              if (body.length) {
                  body += "&amp;";
              }
              body += key + "=";
              body += encodeURIComponent(data[key]);
          }
          xhr.setRequestHeader("Authorization", "Basic " + btoa(client_id + ":" + client_secret));
          xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
          xhr.send(body);
      }
  </code></pre>
  
  <p>The access token is returned from identity server and user is authenticated. Then I use this token to send request to my Web Api. </p>
  
  <p>The problem is that when I check if the user is assigned a role, I find the claim doesn't exist.</p>
  
  <pre><code>    [Authorize]
      // GET api/values
      public IEnumerable&lt;string&gt; Get()
      {
          var id = RequestContext.Principal as ClaimsPrincipal;
          bool geek = id.HasClaim("role", "Geek");  // false here
          bool asset_mgr = id.HasClaim("role", "asset_manager"); // false here
          return new string[] { "value1", "value2" };
      }
  </code></pre>
  
  <p>Here is how the client is defined in identity server.</p>
  
  <pre><code>new Client 
              {
                  ClientName = "Client",
                  ClientId = "client_id",
                  Flow = Flows.ResourceOwner,
                  RequireConsent = false,
                  AllowRememberConsent = false,
  
                  AllowedScopes = new List&lt;string&gt;
                  {
                      "openid",
                      "profile",
                      "roles",
                      "sampleApi"
                  },
                  AbsoluteRefreshTokenLifetime = 86400,
                  SlidingRefreshTokenLifetime = 43200,
                  RefreshTokenUsage = TokenUsage.OneTimeOnly,
                  RefreshTokenExpiration = TokenExpiration.Sliding,
                  ClientSecrets = new List&lt;Secret&gt;
                  {
                      new Secret("4C701024-0770-4794-B93D-52B5EB6487A0".Sha256())
                  },
              },
  </code></pre>
  
  <p>and this is how the user is defined:</p>
  
  <pre><code>new InMemoryUser
              {
                  Username = "bob",
                  Password = "secret",
                  Subject = "1",
  
                  Claims = new[]
                  {
                      new Claim(Constants.ClaimTypes.GivenName, "Bob"),
                      new Claim(Constants.ClaimTypes.FamilyName, "Smith"),
                      new Claim(Constants.ClaimTypes.Role, "Geek"),
                      new Claim(Constants.ClaimTypes.Role, "Foo")
                  }
              }
  </code></pre>
  
  <p>How can I add claims to the access_token in this case? Thanks a lot!</p>