title: IdentityServer 4 - Adding a custom claim to a User when using Implicit grant type
body: <p>I'm going through the tutorial of IdentityServer 4 where is explained how to add user authentication with OpenID Connect, it can be found here:</p>
  
  <p><a href="http://docs.identityserver.io/en/latest/quickstarts/3_interactive_login.html" rel="nofollow noreferrer">http://docs.identityserver.io/en/latest/quickstarts/3_interactive_login.html</a></p>
  
  <p>Basically in this tutorial we have an MVC application with a controller action decorated with a Authorized attribute.
  Each time a user tries to access that action, in case he/she is not logged in, the MVC application redirects the user to Identity Server so he/she can input the login credentials.
  If the credentials are correct, Identity Server redirects back to the MVC application where a page with the User's credentials is shown.
  I've concluded the tutorial and now I want to explore a bit more by adding new claims to the token but I haven't been successful so far.
  In the tutorial, the scopes OpenId and Profile are added by setting the AllowedScopes on the Client configuration.
  I tried to do create a "age" scope and add it in the same manner, but it didn't work.
  Does anyone have an idea how I can do this?
  The code is shown bellow (commented lines are stuff I already tried).</p>
  
  <p>IdentityServer setup:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddMvc();
  
      // configure identity server with in-memory stores, keys, clients and scopes
      services.AddIdentityServer()
          .AddDeveloperSigningCredential()
          .AddInMemoryIdentityResources(Config.GetIdentityResources())
          .AddInMemoryClients(Config.GetClients())
          .AddTestUsers(Config.GetUsers());
  }
  </code></pre>
  
  <p>In memory stores config:</p>
  
  <pre><code>public class Config
  {
      public static IEnumerable&lt;Client&gt; GetClients()
      {
          return new List&lt;Client&gt;()
          {
              new Client
              {
                  ClientId = "mvc",
                  ClientName = "MVC Client",
                  AllowedGrantTypes = GrantTypes.Implicit,
  
                  // where to redirect to after login
                  RedirectUris = { "http://localhost:5002/signin-oidc" },
  
                  // where to redirect to after logout
                  PostLogoutRedirectUris = { "http://localhost:5002/signout-callback-oidc" },
                  RequireConsent = false,
                  //AlwaysIncludeUserClaimsInIdToken = true,
                  //AlwaysSendClientClaims = true,
                  //AllowAccessTokensViaBrowser = true,
  
                  AllowedScopes = new List&lt;string&gt;
                  {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      "age"
                  }
              }
          };
      }
  
      public static List&lt;TestUser&gt; GetUsers()
      {
          return new List&lt;TestUser&gt;()
          {
              new TestUser()
              {
                  SubjectId = "1",
                  Username = "alice",
                  Password = "password",
                  Claims = new List&lt;Claim&gt;()
                  {
                      new Claim("age", "15"),
                      new Claim("name", "Alice"),
                      new Claim("website", "https://alice.com")
                  }
              },
  
              new TestUser()
              {
                  SubjectId = "2",
                  Username = "bob",
                  Password = "password",
                  Claims = new List&lt;Claim&gt;()
                  {
                      new Claim("age", "16"),
                      new Claim("name", "Bob"),
                      new Claim("website", "https://bob.com")
                  }
              }
           };
       }
  
       public static IEnumerable&lt;IdentityResource&gt; GetIdentityResources()
       {
          return new List&lt;IdentityResource&gt;
          {
              new IdentityResources.OpenId(),
              new IdentityResources.Profile(),
              new IdentityResource()
              {
                  DisplayName = "Age",
                  Name = "age",
                  UserClaims = new List&lt;string&gt;()
                  {
                      "age"
                  }
              }
          };
      }
  }
  </code></pre>
  
  <p>MVC Application Config:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddMvcCore()
          .AddRazorViewEngine()
          .AddAuthorization()
          .AddJsonFormatters();
  
      JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
  
      services.AddAuthentication(options =&gt;
      {
          options.DefaultScheme = "Cookies";
          options.DefaultChallengeScheme = "oidc";
      })
      .AddCookie("Cookies")
      .AddOpenIdConnect("oidc", options =&gt;
      {
          options.SignInScheme = "Cookies";
          options.Authority = "http://localhost:5000";
          options.RequireHttpsMetadata = false;
  
          options.ClientId = "mvc";
          options.SaveTokens = true;
      });
  
  }
  </code></pre>
  
  <p>MVC Application Claims Page:</p>
  
  <pre><code>&lt;dl&gt;
      @foreach (var claim in User.Claims)
      {
          &lt;dt&gt;@claim.Type&lt;/dt&gt;
          &lt;dd&gt;@claim.Value&lt;/dd&gt;
      }
  &lt;/dl&gt;
  </code></pre>
  
  <p>This is the result after a successful login:</p>
  
  <p>sid
  ba7ecb47f66524acce04e321b8d2c444</p>
  
  <p>sub
  2</p>
  
  <p>idp
  local</p>
  
  <p>name
  Bob</p>
  
  <p>website
  <a href="https://bob.com" rel="nofollow noreferrer">https://bob.com</a></p>
  
  <p>As you can see the profile claims (name and website) show up, but the custom "age" claim does not.</p>