using System;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.DependencyInjection;

namespace IdentityServer
{
    public class Startup
    {
        public IHostingEnvironment Environment { get; }

        public Startup(IHostingEnvironment environment)
        {
            Environment = environment;
        }

        public void ConfigureServices(IServiceCollection services)
        {
            var builder = services.AddIdentityServer()
                .AddInMemoryIdentityResources(Config.GetIdentityResources())
                .AddInMemoryApiResources(Config.GetApis())
                .AddInMemoryClients(Config.GetClients());

            if (Environment.IsDevelopment())
            {
                builder.AddDeveloperSigningCredential();
            }
            else
            {
                throw new Exception("need to configure key material");
            }
        }

        public void Configure(IApplicationBuilder app)
        {
            if (Environment.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseIdentityServer();
        }
    }
}

using IdentityServer4.Models;
using System.Collections.Generic;

namespace IdentityServer
{
    public static class Config
    {
        public static IEnumerable<IdentityResource> GetIdentityResources()
        {
            return new IdentityResource[]
            {
                new IdentityResources.OpenId()
            };
        }

        public static IEnumerable<ApiResource> GetApis()
        {
            return new List<ApiResource>
            {
                new ApiResource("api1", "My API")
            };
        }

        public static IEnumerable<Client> GetClients()
        {
            return new List<Client>
            {
                new Client
                {
                    ClientId = "client",

                    // no interactive user, use the clientid/secret for authentication
                    AllowedGrantTypes = GrantTypes.ClientCredentials,

                    // secret for authentication
                    ClientSecrets =
                    {
                        new Secret("secret".Sha256())
                    },

                    // scopes that client has access to
                    AllowedScopes = { "api1" }
                }
            };
        }
    }
}

//用戶(hù)交互的選項(xiàng)
options.UserInteraction = new IdentityServer4.Configuration.UserInteractionOptions
{
    LoginUrl = "/login/index",//登錄地址
};

using HyIdentityServer4.Authorization;
using HyIdentityServer4.Data;
using HyIdentityServer4.Extention;
using HyIdentityServer4.Implementation;
using IdentityServer4.Services;
using IdentityServer4.Validation;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using System;
using System.IO;
using System.Reflection;
using System.Security.Cryptography.X509Certificates;

namespace HyIdentityServer4
{
    public class Startup
    {
        public Startup(IConfiguration configuration, IWebHostEnvironment environment)
        {
            Configuration = configuration;
            Environment = environment;
        }
        
        public IConfiguration Configuration { get; }
        public IWebHostEnvironment Environment { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            //session配置           
            services.AddSession(options =>
            {
                options.IdleTimeout = TimeSpan.FromMinutes(30);
            });

            //cookie samesite策略
            services.AddSameSiteCookiePolicy();

            #region 注入EFCore服務(wù)（支持mysql和sqlserver）
#if DEBUG
            string connectionString = Configuration.GetConnectionString("HyIds4ConnectionDebug");
#else
            string connectionString = Configuration.GetConnectionString("HyIds4ConnectionRelease");
#endif
            bool isMysql = Configuration.GetConnectionString("IsMysql").ObjToBool();
            if (isMysql)
            {
                services.AddDbContext<ApplicationDbContext>(options => options.UseMySql(connectionString, MySqlServerVersion.LatestSupportedServerVersion));
            }
            else
            {
                services.AddDbContext<ApplicationDbContext>(options => options.UseSqlServer(connectionString));
            };
            #endregion           

            #region 注入IdentityServer4服務(wù)
            var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;
            var builder = services.AddIdentityServer(options =>
            {
                options.Events.RaiseErrorEvents = true;//是否引發(fā)錯(cuò)誤事件
                options.Events.RaiseInformationEvents = true;//是否引發(fā)信息事件
                options.Events.RaiseFailureEvents = true;//是否引發(fā)失敗事件
                options.Events.RaiseSuccessEvents = true;//是否引發(fā)成功事件             
                //用戶(hù)交互的選項(xiàng)
                options.UserInteraction = new IdentityServer4.Configuration.UserInteractionOptions
                {
                    LoginUrl = "/login/index",//登錄地址
                };
            })
            //IdentityServer4使用asp.net identity身份實(shí)現(xiàn)
            .AddAspNetIdentity<IdentityUser>()
            //IdentityServer4采用EFCore的方式實(shí)現(xiàn)數(shù)據(jù)庫(kù)模式
            .AddConfigurationStore(options =>
            {
                if (isMysql)
                {
                    options.ConfigureDbContext = b => b.UseMySql(connectionString, MySqlServerVersion.LatestSupportedServerVersion, sql => sql.MigrationsAssembly(migrationsAssembly));
                }
                else
                {
                    options.ConfigureDbContext = b => b.UseSqlServer(connectionString, sql => sql.MigrationsAssembly(migrationsAssembly));
                }
            })
            // IdentityServer4采用EFCore進(jìn)行一些操作，實(shí)現(xiàn)持久化
            .AddOperationalStore(options =>
            {
                if (isMysql)
                {
                    options.ConfigureDbContext = b => b.UseMySql(connectionString, MySqlServerVersion.LatestSupportedServerVersion, sql => sql.MigrationsAssembly(migrationsAssembly));
                }
                else
                {
                    options.ConfigureDbContext = b => b.UseSqlServer(connectionString, sql => sql.MigrationsAssembly(migrationsAssembly));
                }

                //是否可以自動(dòng)清理令牌
                options.EnableTokenCleanup = true;
                //設(shè)置清理的間隔（頻率），以秒為單位
                options.TokenCleanupInterval = 15;
            });
            //配置證書(shū)
            if (Environment.IsDevelopment())
            {
                builder.AddDeveloperSigningCredential();
            }
            else
            {
                builder.AddDeveloperSigningCredential();
                //builder.AddSigningCredential(new X509Certificate2(
                //    Path.Combine(Environment.ContentRootPath, Configuration["Certificates:CerPath"]), Configuration["Certificates:Password"]
                //    ));
            }
            //https://www.javaroad.cn/questions/53540
            services.AddTransient<IResourceOwnerPasswordValidator, CustomResourceOwnerPasswordValidator>();//重寫(xiě)
            services.AddTransient<IProfileService, CustomProfileService>();//重寫(xiě)
            services.AddAuthorization(options =>
            {
                options.AddPolicy("超級(jí)管理員", policy => policy.Requirements.Add(new ClaimRequirement("rolename", "超級(jí)管理員")));
            });
            //實(shí)現(xiàn)此接口的類(lèi)能夠決定是否授權(quán)是被允許的。
            services.AddSingleton<IAuthorizationHandler, ClaimsRequirementHandler>();//重寫(xiě)
            #endregion

            services.AddControllersWithViews();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            app.UseCookiePolicy();
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }
            app.UseSession();
            app.UseStaticFiles();
            app.UseSession();
            app.UseRouting();
            app.UseIdentityServer();
            app.UseAuthentication();
            app.UseAuthorization();
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                    name: "default",
                    pattern: "{controller=home}/{action=index}/{id?}");
            });
        }
    }
}

#region 注入Identity服務(wù)
   //IdentityOptions文檔說(shuō)明
   //https://docs.microsoft.com/zh-cn/dotnet/api/microsoft.aspnetcore.builder.identityoptions?view=aspnetcore-1.1
   //AddIdentity為指定的用戶(hù)和角色類(lèi)型添加并配置身份系統(tǒng)。
   services.AddIdentity<IdentityUser, IdentityRole>(options =>
   {
       options.User = new UserOptions
       {
             RequireUniqueEmail = true, //要求Email唯一
             AllowedUserNameCharacters = null //允許的用戶(hù)名字符
       };
       options.Password = new PasswordOptions
       {
            RequiredLength = 6, //要求密碼最小長(zhǎng)度，默認(rèn)是 6 個(gè)字符
            RequireDigit = false, //要求有數(shù)字
            RequiredUniqueChars = 0, //要求至少要出現(xiàn)的字母數(shù)
            RequireLowercase = false, //要求小寫(xiě)字母
            RequireNonAlphanumeric = false, //要求特殊字符
            RequireUppercase = false //要求大寫(xiě)字母
        };
    })
    //認(rèn)證信息存儲(chǔ)的框架實(shí)現(xiàn)
    .AddEntityFrameworkStores<ApplicationDbContext>()
    //令牌提供程序,用于生成重置密碼的令牌、更改電子郵件和更改電話號(hào)碼操作以及雙因素身份驗(yàn)證的令牌
    .AddDefaultTokenProviders();
    //配置應(yīng)用的cookie
    services.ConfigureApplicationCookie(options =>
    {
        //重定向
        options.LoginPath = new PathString("/login/index");
     });
     //配置session的有效時(shí)間,單位秒
     services.AddSession(options =>
     {
         options.IdleTimeout = TimeSpan.FromSeconds(180);
     });
     #endregion

services.AddAuthorization(options =>
{
     options.AddPolicy("超級(jí)管理員", policy => policy.Requirements.Add(new ClaimRequirement("rolename", "超級(jí)管理員")));
});

using HyIdentityServer4.Authorization;
using HyIdentityServer4.Data;
using HyIdentityServer4.Extention;
using HyIdentityServer4.Implementation;
using IdentityServer4.Services;
using IdentityServer4.Validation;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using System;
using System.IO;
using System.Reflection;
using System.Security.Cryptography.X509Certificates;

namespace HyIdentityServer4
{
    public class Startup
    {
        public Startup(IConfiguration configuration, IWebHostEnvironment environment)
        {
            Configuration = configuration;
            Environment = environment;
        }
        
        public IConfiguration Configuration { get; }
        public IWebHostEnvironment Environment { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            //session配置           
            services.AddSession(options =>
            {
                options.IdleTimeout = TimeSpan.FromMinutes(30);
            });

            //cookie samesite策略
            services.AddSameSiteCookiePolicy();

            #region 注入EFCore服務(wù)
#if DEBUG
            string connectionString = Configuration.GetConnectionString("HyIds4ConnectionDebug");
#else
            string connectionString = Configuration.GetConnectionString("HyIds4ConnectionRelease");
#endif
            bool isMysql = Configuration.GetConnectionString("IsMysql").ObjToBool();
            if (isMysql)
            {
                services.AddDbContext<ApplicationDbContext>(options => options.UseMySql(connectionString, MySqlServerVersion.LatestSupportedServerVersion));
            }
            else
            {
                services.AddDbContext<ApplicationDbContext>(options => options.UseSqlServer(connectionString));
            };
            #endregion

            #region 注入Identity服務(wù)
            //IdentityOptions文檔說(shuō)明
            //https://docs.microsoft.com/zh-cn/dotnet/api/microsoft.aspnetcore.builder.identityoptions?view=aspnetcore-1.1
            //AddIdentity為指定的用戶(hù)和角色類(lèi)型添加并配置身份系統(tǒng)。
            services.AddIdentity<IdentityUser, IdentityRole>(options =>
            {
                options.User = new UserOptions
                {
                    RequireUniqueEmail = true, //要求Email唯一
                    AllowedUserNameCharacters = null //允許的用戶(hù)名字符
                };
                options.Password = new PasswordOptions
                {
                    RequiredLength = 1, //要求密碼最小長(zhǎng)度，默認(rèn)是 6 個(gè)字符
                    RequireDigit = false, //要求有數(shù)字
                    RequiredUniqueChars = 0, //要求至少要出現(xiàn)的字母數(shù)
                    RequireLowercase = false, //要求小寫(xiě)字母
                    RequireNonAlphanumeric = false, //要求特殊字符
                    RequireUppercase = false //要求大寫(xiě)字母
                };
            })
            //認(rèn)證信息存儲(chǔ)的框架實(shí)現(xiàn)
            .AddEntityFrameworkStores<ApplicationDbContext>()
            //令牌提供程序,用于生成重置密碼的令牌、更改電子郵件和更改電話號(hào)碼操作以及雙因素身份驗(yàn)證的令牌
            .AddDefaultTokenProviders();
            //配置應(yīng)用的cookie
            services.ConfigureApplicationCookie(options =>
            {
                //重定向
                options.LoginPath = new PathString("/login/index");
            });
            //配置session的有效時(shí)間,單位秒
            services.AddSession(options =>
            {
                options.IdleTimeout = TimeSpan.FromSeconds(180);
            });
            #endregion

            #region 注入IdentityServer4服務(wù)
            var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;
            var builder = services.AddIdentityServer(options =>
            {
                options.Events.RaiseErrorEvents = true;//是否引發(fā)錯(cuò)誤事件
                options.Events.RaiseInformationEvents = true;//是否引發(fā)信息事件
                options.Events.RaiseFailureEvents = true;//是否引發(fā)失敗事件
                options.Events.RaiseSuccessEvents = true;//是否引發(fā)成功事件             
                //用戶(hù)交互的選項(xiàng)
                options.UserInteraction = new IdentityServer4.Configuration.UserInteractionOptions
                {
                    LoginUrl = "/login/index",//登錄地址
                };
            })
            //IdentityServer4使用asp.net identity身份實(shí)現(xiàn)
            .AddAspNetIdentity<IdentityUser>()
            //IdentityServer4采用EFCore的方式實(shí)現(xiàn)數(shù)據(jù)庫(kù)模式
            .AddConfigurationStore(options =>
            {
                if (isMysql)
                {
                    options.ConfigureDbContext = b => b.UseMySql(connectionString, MySqlServerVersion.LatestSupportedServerVersion, sql => sql.MigrationsAssembly(migrationsAssembly));
                }
                else
                {
                    options.ConfigureDbContext = b => b.UseSqlServer(connectionString, sql => sql.MigrationsAssembly(migrationsAssembly));
                }
            })
            // IdentityServer4采用EFCore進(jìn)行一些操作，實(shí)現(xiàn)持久化
            .AddOperationalStore(options =>
            {
                if (isMysql)
                {
                    options.ConfigureDbContext = b => b.UseMySql(connectionString, MySqlServerVersion.LatestSupportedServerVersion, sql => sql.MigrationsAssembly(migrationsAssembly));
                }
                else
                {
                    options.ConfigureDbContext = b => b.UseSqlServer(connectionString, sql => sql.MigrationsAssembly(migrationsAssembly));
                }

                //是否可以自動(dòng)清理令牌
                options.EnableTokenCleanup = true;
                //設(shè)置清理的間隔（頻率），以秒為單位
                options.TokenCleanupInterval = 15;
            });
            //配置證書(shū)
            if (Environment.IsDevelopment())
            {
                builder.AddDeveloperSigningCredential();
            }
            else
            {
                builder.AddDeveloperSigningCredential();
                //builder.AddSigningCredential(new X509Certificate2(
                //    Path.Combine(Environment.ContentRootPath, Configuration["Certificates:CerPath"]), Configuration["Certificates:Password"]
                //    ));
            }
            //https://www.javaroad.cn/questions/53540
            services.AddTransient<IResourceOwnerPasswordValidator, CustomResourceOwnerPasswordValidator>();
            services.AddTransient<IProfileService, CustomProfileService>();
            services.AddAuthorization(options =>
            {
                options.AddPolicy("超級(jí)管理員", policy => policy.Requirements.Add(new ClaimRequirement("rolename", "超級(jí)管理員")));
            });
            //實(shí)現(xiàn)此接口的類(lèi)能夠決定是否授權(quán)是被允許的。
            services.AddSingleton<IAuthorizationHandler, ClaimsRequirementHandler>();
            #endregion

            services.AddControllersWithViews();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            app.UseCookiePolicy();
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }
            app.UseSession();
            app.UseStaticFiles();
            app.UseSession();
            app.UseRouting();
            app.UseIdentityServer();
            app.UseAuthentication();
            app.UseAuthorization();
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                    name: "default",
                    pattern: "{controller=home}/{action=index}/{id?}");
            });
        }
    }
}

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace HyIdentityServer4.Controllers
{
    //[SecurityHeaders]
    [Authorize(Policy = "超級(jí)管理員")]
    public class BaseController : Controller
    {

    }
}

public class ResourceOwnerPasswordValidator : IResourceOwnerPasswordValidator
{
    private readonly UserManager<ApplicationUser> _userManager;

    public ResourceOwnerPasswordValidator(UserManager<ApplicationUser> userManager)
    {
        _userManager = userManager;
    }

    public Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
    {
        var userTask = _userManager.FindByNameAsync(context.UserName);
        var user = userTask.Result;

        context.Result = new GrantValidationResult(user.Id, "password", null, "local", null);
        return Task.FromResult(context.Result);
    }
}
和

public class AspNetIdentityProfileService : IProfileService
{
    private readonly UserManager<ApplicationUser> _userManager;

    public AspNetIdentityProfileService(UserManager<ApplicationUser> userManager)
    {
        _userManager = userManager;
    }

    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        var subject = context.Subject;
        if (subject == null) throw new ArgumentNullException(nameof(context.Subject));

        var subjectId = subject.GetSubjectId();

        var user = await _userManager.FindByIdAsync(subjectId);
        if (user == null)
            throw new ArgumentException("Invalid subject identifier");

        var claims = await GetClaimsFromUser(user);

        var siteIdClaim = claims.SingleOrDefault(x => x.Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress");
        context.IssuedClaims.Add(new Claim(JwtClaimTypes.Email, user.Email));
        context.IssuedClaims.Add(new Claim("siteid", siteIdClaim.Value));
        context.IssuedClaims.Add(new Claim(JwtClaimTypes.Role, "User"));

        var roleClaims = claims.Where(x => x.Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/role");
        foreach (var roleClaim in roleClaims)
        {
            context.IssuedClaims.Add(new Claim(JwtClaimTypes.Role, roleClaim.Value));
        }
    }

    public async Task IsActiveAsync(IsActiveContext context)
    {
        var subject = context.Subject;
        if (subject == null) throw new ArgumentNullException(nameof(context.Subject));

        var subjectId = subject.GetSubjectId();
        var user = await _userManager.FindByIdAsync(subjectId);

        context.IsActive = false;

        if (user != null)
        {
            if (_userManager.SupportsUserSecurityStamp)
            {
                var security_stamp = subject.Claims.Where(c => c.Type == "security_stamp").Select(c => c.Value).SingleOrDefault();
                if (security_stamp != null)
                {
                    var db_security_stamp = await _userManager.GetSecurityStampAsync(user);
                    if (db_security_stamp != security_stamp)
                        return;
                }
            }

            context.IsActive =
                !user.LockoutEnabled ||
                !user.LockoutEnd.HasValue ||
                user.LockoutEnd <= DateTime.Now;
        }
    }

    private async Task<IEnumerable<Claim>> GetClaimsFromUser(ApplicationUser user)
    {
        var claims = new List<Claim>
        {
            new Claim(JwtClaimTypes.Subject, user.Id),
            new Claim(JwtClaimTypes.PreferredUserName, user.UserName)
        };

        if (_userManager.SupportsUserEmail)
        {
            claims.AddRange(new[]
            {
                new Claim(JwtClaimTypes.Email, user.Email),
                new Claim(JwtClaimTypes.EmailVerified, user.EmailConfirmed ? "true" : "false", ClaimValueTypes.Boolean)
            });
        }

        if (_userManager.SupportsUserPhoneNumber && !string.IsNullOrWhiteSpace(user.PhoneNumber))
        {
            claims.AddRange(new[]
            {
                new Claim(JwtClaimTypes.PhoneNumber, user.PhoneNumber),
                new Claim(JwtClaimTypes.PhoneNumberVerified, user.PhoneNumberConfirmed ? "true" : "false", ClaimValueTypes.Boolean)
            });
        }

        if (_userManager.SupportsUserClaim)
        {
            claims.AddRange(await _userManager.GetClaimsAsync(user));
        }

        if (_userManager.SupportsUserRole)
        {
            var roles = await _userManager.GetRolesAsync(user);
            claims.AddRange(roles.Select(role => new Claim(JwtClaimTypes.Role, role)));
        }

        return claims;
    }
}

services.AddTransient<IResourceOwnerPasswordValidator, ResourceOwnerPasswordValidator>();
services.AddTransient<IProfileService, AspNetIdentityProfileService>();

/// <summary>
    /// 為用戶(hù)創(chuàng)建token
    /// </summary>
    private async Task<TokenDto> CreateToken(Client client, CreateTokenInput input)
    {
        Token accessToken = await CreateAccessToken(client, input);
        string token = await _tokenService.CreateSecurityTokenAsync(accessToken);
        return new TokenDto()
        {
            AccessToken = token,
            ExpiresIn = input.Lifetime > 0 ? input.Lifetime : client.AccessTokenLifetime,
            TokenType = "Bearer"
        };
    }

    /// <summary>
    /// 創(chuàng)建生成jwt的Token所包含信息
    /// </summary>
    /// <param name="client"></param>
    /// <param name="input"></param>
    /// <returns></returns>
    private async Task<Token> CreateAccessToken(Client client, CreateTokenInput input)
    {
        #region claims

        //, string subjectId, int lifetime, params string[] scopes
        var claims = new List<Claim>
        {
            new Claim(JwtClaimTypes.ClientId, client.ClientId),
            new Claim(JwtClaimTypes.Id, input.SubjectId),
        };
        input.Claims?.ForEach(c => claims.Add(c));
        input.Scopes?.ForEach(s => claims.Add(new Claim(JwtClaimTypes.Scope, s)));
        //client scopes
        claims.AddRange(client.AllowedScopes.Select(s => new Claim(JwtClaimTypes.Scope, s)));

        #endregion

        #region aud

        var website = _configuration.GetValue<string>("AuthWebSite", "").RemoveTrailingSlash();
        List<string> aud = new List<string>() { string.Concat(website, "/resources") };
        //client aud:apiResourceName
        var apiResourceNameList = await _identityServer4Service.GetApiResourceNames(client.AllowedScopes.ToList());
        aud.AddRange(apiResourceNameList ?? new List<string>());

        #endregion

        var token = new Token(OidcConstants.TokenTypes.AccessToken)
        {
            CreationTime = DateTime.UtcNow,
            Claims = claims,
            Audiences = aud,
            Issuer = website,
            Lifetime = input.Lifetime > 0 ? input.Lifetime : client.AccessTokenLifetime,
            ClientId = client.ClientId,
            AccessTokenType = client.AccessTokenType,
            //Scopes = client.AllowedScopes.ToList(),
        };

        return token;
    }

    #endregion