How to add claims to my accesstoken generated by IdentityServer4 using ClientCredentials grantType

Question

I had developed a WebAPI application and secured my endpoints with OAuth 2.0 protocol using IdentityServer4

My ApiResource looks like:

                     Name = "BankOfDotNetApi",
                     Scopes =
                     {
                        new Scope("BankOfDotNetApi", "API name for Customer", new List<string>{ "Claim1"}),
                        new Scope("BankOfDotNetApi.Read"),
                        new Scope("BankOfDotNetApi.Write"),
                        new Scope("offline_access"),
                    },
                    UserClaims =
                    {
                        JwtClaimTypes.Name,
                        JwtClaimTypes.Email
                    },

MyClient looks like:

                Client
                {
                    ClientId = "client",
                    AllowedGrantTypes = GrantTypes.ClientCredentials,
                    ClientSecrets = {new Secret("secret".Sha256())},
                    AllowedScopes = { "BankOfDotNetApi", "BankOfDotNetApi.Read" },
                }

My API application startUp.cs looks like:

    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvc(
                config =>
                {
                });

            services.AddControllers();
            services.AddDbContext<BankContext>(options => options.UseInMemoryDatabase("BankingDb"));

            services.AddAuthentication("Bearer")
                     .AddIdentityServerAuthentication(options =>
                     {
                         options.RequireHttpsMetadata = false;
                         options.ApiName = "BankOfDotNetApi";
                         options.Authority = "http://localhost:5000";
                     });
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseHttpsRedirection();

            app.UseRouting();

            app.UseAuthentication();

            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }

I am not generating tokens manually(by creating an instance of JWTToken)and Tokens are automatically generated by IdentityServer4

I am able to access scopes in my access token but I am unable to access Claims.
If my code goes wrong, please suggest to me how and Where to add claims to my ApiResource.
How to access claims in my AccessToken

Answer 1

Use ICustomTokenRequestValidator interface, after token generation, control flow comes in ValidateAsync method.

namespace IdentityServer4.Validation
{
    //
    // Summary:
    //     Allows inserting custom validation logic into authorize and token requests
    public interface ICustomTokenRequestValidator
    {
        //
        // Summary:
        //     Custom validation logic for a token request.
        //
        // Parameters:
        //   context:
        //     The context.
        //
        // Returns:
        //     The validation result
        Task ValidateAsync(CustomTokenRequestValidationContext context);
    }
}

Use below line to add custom claim in token.

context.Result.ValidatedRequest.ClientClaims.Add(claim);

Adds the custom authorize request validator using AddCustomTokenRequestValidator in startup class.