What is a ProfileService/When is a ProfileService executed?

Question

I've been playing with IdentityServer4. Absolutely love it.

I've been going through the tutorials on your site, specifically https://identityserver4.readthedocs.io/en/release/quickstarts/7_javascript_client.html

I have created a Profile Service that does the following:

public class ProfileService : IProfileService
{
    public Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        context.IssuedClaims.Add(new Claim("test-claim", "test-value"));
        return Task.FromResult(0);
    }

    public Task IsActiveAsync(IsActiveContext context)
    {
        context.IsActive = true;

        return Task.FromResult(0);
    }
}

This works great, my custom claim is visible in the log window of my JS client.

I put a break point on it just to inspect what is in the context, and I noticed it was getting hit twice. The caller properties were ClaimsProviderAccessToken and UserInfoEndpoint respectively. Why is this?

In my naivety I removed the profile scope from my js client, and in oidc-js config also removed the profile scope, and set loadUserInfo: false yet my ProfileService it is still called twice.

If my end goal is to set claims based on parameters from a database, I really I don't want to be doing this operaion twice, do I? (Genuine question -- I don't know). A 'solution' would be to only set them on "ClaimsProviderAccessToken" but there is something telling me that there will be a reason ProfileServices get called twice and that there is some importance of it setting the claims on both runs through.

Bipetalous

Microsoft.EntityFrameworkCore.Tools.DotNet is only, if you want the commands to be available in with dotnet command, i.e. dotnet ef database update. Microsoft.EntityFrameworkCore.Tools is stil there and available, but will only be available in package manager console (Powershell commands, like Migration-Add or Database-Update as it was used in previous versions of EF, like EF6). Also see github.com/aspnet/Announcements/issues/208 – Helices

Answer 1

The profile service is called whenever IdentityServer needs to return claims about a user to a client applications.

If you request an identity and access token - it will get called twice (since you might be putting different claims into each token type).

Mucro