Swashbuckle .net core

[dan.woda]

Do you have any custom rules that limit scopes?

ID token missing email and profile claims

Support clarified what was happening here, maybe this will help others. The request I posted was doing two things: Asking for authorization for the https://localhost audience, and requesting an id token. The audience parameter appears unnecessary in this case. The id token scopes were being ignored because I had a rule running that restricted access token scopes. It turns out that in order to request e.g. the “email” scope for the id token, rules must allow that scope on access tokens as well. …