Verified:Website 𝕏@duendeidentity GitHub

claims-authorization

Load and filter user claims during token issuance according to requested scopes.

10|2|Updated Mar 16, 2026

Search Tags:#claims #claims-transformation #identityserver #extension-grants #profile-service #dynamic-claims #token-issuance

Ready to run

npx skills add https://github.com/DuendeSoftware/duende-skills --skill claims-authorization

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: claims-authorization
Source: https://github.com/DuendeSoftware/duende-skills/tree/main/skills/claims-authorization
Command: npx skills add https://github.com/DuendeSoftware/duende-skills --skill claims-authorization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Mapping and controlling claims emitted by IdentityServer is complex and error-prone; this skill provides patterns and examples for IProfileService, IClaimsTransformation, and extension grants to ensure accurate, scope-aware claims loading, mapping, and filtering.

Core Features & Use Cases

Dynamic claims loading: fetches and emits claims at token issuance based on user, client, and scope.
Profile service patterns: demonstrates implementing IProfileService with GetProfileDataAsync and IsActiveAsync for robust token customization.
Extension grants and external providers: shows how to propagate custom claims from token exchanges and map external provider claims into the local user profile.

Quick Start

Implement a custom profile service by extending DefaultProfileService and override GetProfileDataAsync to load dynamic claims from your data source.

Frequently Asked Questions about claims-authorization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I load dynamic claims during token issuance in IdentityServer?▼

Dynamic claims loading during token issuance in IdentityServer is handled by implementing IProfileService. You override GetProfileDataAsync to fetch and emit claims based on the specific user, client, and requested scopes at runtime.

What is the best way to map external provider claims into a local IdentityServer profile?▼

Mapping external provider claims into a local IdentityServer profile uses IClaimsTransformation patterns. This propagates custom claims from token exchanges and external providers into the local user profile during the authentication pipeline.

How do I filter user claims to align with requested scopes in IdentityServer?▼

Filtering user claims to align with requested scopes in IdentityServer requires a custom profile service. Extending DefaultProfileService and overriding GetProfileDataAsync ensures accurate, scope-aware claims loading and filtering for token generation.

Can I propagate custom claims using extension grants in IdentityServer?▼

Extension grants in IdentityServer support propagating custom claims during token exchanges. The skill provides patterns to map and extend profile data, ensuring custom claims are correctly included in the newly issued tokens.

Why do I need to implement IsActive checks in an IdentityServer profile service?▼

IsActive checks in an IdentityServer profile service validate if the user is still active and authorized. Implementing IsActiveAsync ensures tokens are only issued to valid users, preventing unauthorized access for inactive accounts.

Does IdentityServer profile service support adding custom claims to access tokens?▼

IdentityServer profile service supports adding custom claims to access tokens. By implementing GetProfileDataAsync, you can control token content and ensure extensible claim propagation directly into the generated tokens.