using refresh_token to get access_token does not contain previous claims

Hi,

I have a custom AuthorizationController where I am using the password grant type to authenticate the user and adding some custom claims. This works fine and returns the JWT with additional properties.

However I’ve noticed when using a refresh token to get a new access token all these claims disappear, so the question is do I have to roll my own endpoint for refresh tokens to be able to set these claims again? If so are there any examples that may help.

Thanks

AuthorizationController

  public class AuthorizeController : Controller
    {
        public AuthorizeController(
            CustomOpenIddictManager userManager)
        {
            _userManager = userManager;
        }

        private CustomOpenIddictManager _userManager { get; set; }

        [HttpPost("~/connect/token")]
        [Produces("application/json")]
        public async Task<IActionResult> Exchange()
        {
            var request = HttpContext.GetOpenIdConnectRequest();

            if (request.IsPasswordGrantType())
            {
                var user = await _userManager.FindByNameAsync(request.Username);
                if (user == null)
                {
                    return BadRequest(new OpenIdConnectResponse
                    {
                        Error = OpenIdConnectConstants.Errors.InvalidGrant,
                        ErrorDescription = "The username/password couple is invalid."
                    });
                }

                // Ensure the password is valid.
                if (!await _userManager.CheckPasswordAsync(user, request.Password))
                {
                    if (_userManager.SupportsUserLockout)
                    {
                        await _userManager.AccessFailedAsync(user);
                    }

                    return BadRequest(new OpenIdConnectResponse
                    {
                        Error = OpenIdConnectConstants.Errors.InvalidGrant,
                        ErrorDescription = "The username/password couple is invalid."
                    });

                }

                if (_userManager.SupportsUserLockout)
                {
                    await _userManager.ResetAccessFailedCountAsync(user);
                }

                var identity = await _userManager.CreateIdentityAsync(user, request.GetScopes());

                // Create a new authentication ticket holding the user identity.
                var ticket = new AuthenticationTicket(
                    new ClaimsPrincipal(identity),
                    new AuthenticationProperties(),
                    OpenIdConnectServerDefaults.AuthenticationScheme);

                ticket.SetResources(request.GetResources());
                ticket.SetScopes(request.GetScopes());

                return SignIn(ticket.Principal, ticket.Properties, ticket.AuthenticationScheme);
            }

            return BadRequest(new OpenIdConnectResponse
            {
                Error = OpenIdConnectConstants.Errors.UnsupportedGrantType,
                ErrorDescription = "The specified grant type is not supported."
            });
        }

[kevinchalet]

This is the “expected” behavior, as custom claims are discarded when using a refresh token (because internally, OpenIddict calls CreateIdentityAsync to generate a fresh new identity and ignores the old claims).

That said, now that you’re responsible of creating authentication tickets, this behavior - inherited from the period where OpenIddict magically handled everything for you - doesn’t make much sense. Not sure what’s the best approach yet, but I’ll work on it.

[kevinchalet]

For reasons I can’t explain, the CodeFlow sample in the openiddict-samples repo already has the right scopes list, but not the sandbox sample used in this repo… most likely a brain bug :trollface: