title: Do not receive refresh token with OpenIddict
body: <p>I have a web api project based on .net core 2.0.</p>
  
  <p>I followed pretty much the very good example on <a href="http://kevinchalet.com/2017/01/30/implementing-simple-token-authentication-in-aspnet-core-with-openiddict/" rel="nofollow noreferrer">http://kevinchalet.com/2017/01/30/implementing-simple-token-authentication-in-aspnet-core-with-openiddict/</a>. </p>
  
  <p>The code that returns the SignIn() result for the auth. method looks like so:</p>
  
  <pre><code>if (request.IsPasswordGrantType())
  {
      // (...)
      if (useraccount != null &amp;&amp; useraccount.Failcount &lt;= AppConstants.AuthMaxAllowedFailedLogin)
      {
          var identity = new ClaimsIdentity(OpenIdConnectServerDefaults.AuthenticationScheme, OpenIdConnectConstants.Claims.Name, OpenIdConnectConstants.Claims.Role);
  
          identity.AddClaim(OpenIdConnectConstants.Claims.Subject, AppConstants.AuthSubjectClaim, OpenIdConnectConstants.Destinations.AccessToken);
          identity.AddClaim(OpenIdConnectConstants.Claims.Name, useraccount.Username, OpenIdConnectConstants.Destinations.AccessToken);
  
          return SignIn(new ClaimsPrincipal(identity), OpenIdConnectServerDefaults.AuthenticationScheme);
      }
      // (...)
  }
  </code></pre>
  
  <p>My startup code looks like so:</p>
  
  <pre><code>services.AddDbContext&lt;DbContext&gt;(options =&gt;
  {
      options.UseInMemoryDatabase(nameof(DbContext));
      options.UseOpenIddict();
  });
  
  services.AddOpenIddict(options =&gt;
  {
      options.AddEntityFrameworkCoreStores&lt;DbContext&gt;();
      options.AddMvcBinders();
      options.EnableTokenEndpoint(DcpConstants.ApiTokenRoute);
      options.AllowPasswordFlow();
      options.AllowRefreshTokenFlow();
      options.SetAccessTokenLifetime(TimeSpan.FromHours(1));
      options.SetRefreshTokenLifetime(TimeSpan.FromDays(1));
      options.DisableHttpsRequirement();
  });
  
  services.AddAuthentication(options =&gt;
  {
      options.DefaultScheme = OAuthValidationDefaults.AuthenticationScheme;
  }).AddOAuthValidation();
  </code></pre>
  
  <p>Now, when I send the post request with the following params:</p>
  
  <pre><code>username: foo@bar.com
  password: myPassword
  grant_type: password
  scope: openid profile offline_access
  </code></pre>
  
  <p>I only receive scope, token_type, access_token, expires_in and id_token and no refresh_token. </p>
  
  <p>What am I missing?</p>