result = userMgr.AddClaimsAsync(alice, new Claim[]{
             new Claim(JwtClaimTypes.GivenName, "Alice"),
             new Claim(JwtClaimTypes.FamilyName, "Smith"),
             new Claim(JwtClaimTypes.Email, "[email protected]"),
             new Claim(JwtClaimTypes.EmailVerified, "true", ClaimValueTypes.Boolean),
             new Claim(JwtClaimTypes.WebSite, "http://alice.com"),
             new Claim(JwtClaimTypes.Address, @"{ 'street_address': 'One Hacker Way', 'locality': 'Heidelberg', 'postal_code': 69118, 'country': 'Germany' }", IdentityServer4.IdentityServerConstants.ClaimValueTypes.Json),
             
             // Add user_scope claim for Identity to authorize UI and API actions. Alice has this claim, Bob does not.
             new Claim("appUser_claim","identity")

new List<IdentityResource>
            {
                new IdentityResources.OpenId(),
                new IdentityResources.Profile(),
                new IdentityResources.Email(),
                // Identity Resource for custom user claim type
                new IdentityResource("appUser_claim", new []{"appUser_claim"})
            };

   new List<ApiResource>
            {   // Identity API, consumes user claim type 'appUser_claim'
                    // Claim Types are the associated user claim types required by this resource (api).
                    // Identity Server will include those claims in Access tokens for this resource when available.
                new ApiResource("identityApi",              // Name
                                "Identity Claims Api",      // Display Name
                                 new []{"appUser_claim"})   // Claim Types
            };

 // interactive ASP.NET Core Blazor Server Client
       new Client
           {
               ClientId = "BlazorID_App",
               ClientName="Blazor Server App - Identity Claims",
               ClientSecrets = { new Secret("secret".Sha256()) },

               // Use Code flow with PKCE (most secure)
               AllowedGrantTypes = GrantTypes.Code,
               RequirePkce = true,
                    
               // Do not require the user to give consent
               RequireConsent = false,                   
                
               // where to redirect to after login
               RedirectUris = { "https://localhost:44321/signin-oidc" },

               // where to redirect to after logout
               PostLogoutRedirectUris = { "https://localhost:44321/signout-callback-oidc" },

               // Allowed Scopes - include Api Resources and Identity Resources that may be accessed by this client
               // The identityApi scope provides access to the API, the appUser_claim scope provides access to the custom Identity Resource
               AllowedScopes = { "openid", "profile", "email", "identityApi","appUser_claim" },

               // AllowOfflineAccess includes the refresh token
               // The application will get a new access token after the old one expires without forcing the user to sign in again.
               // Token management is done by the middleware, but the client must be allowed access here and the offline_access scope must be added in the OIDC settings in client Startup.ConfigureServices
               AllowOfflineAccess = true
           }

 //create base controller route
   [Route("api/identity")]

   // This authorize attribute challenges all clients attempting to access all controller methods.
   // Clients must posses the client scope claim "identityApi" (api resource in IdentityServer)
   // It is not actually required in this specific case, because there is only one method and it has its own Authorize attribute.
   // However, it is a common practice to have this controller level attribute to ensure that Identity Server is protecting the entire controller, including methods that may be added in the future.
   [Authorize]

   public class IdentityController : ControllerBase
   {
       [HttpGet]
       // Use samed shared authorization policy to protect the api GET method that is used to protect the application feature
       // This checks for the user claim type appRole_Claim with value "identity".
       [Authorize(Policy = Policies.CanViewIdentity)]
       public IActionResult Get()
       {
           // return the claim set of the current API user as Json
           return new JsonResult(from c in User.Claims select new { c.Type, c.Value });
       }
   }

  public static AuthorizationPolicy CanViewIdentityPolicy()
     {
         return new AuthorizationPolicyBuilder()
             .RequireAuthenticatedUser()
             .RequireClaim("appuser_claim", "identity")
             .Build();
     }

            services.AddControllers()
                .AddNewtonsoftJson();

            // configure bearer token authentication
            services.AddAuthentication("Bearer")
                .AddJwtBearer("Bearer", options =>
                {
                    //IDentityServer url
                    options.Authority = "https://localhost:44387";
                    
                    // RequireHttpsMetadata must be true in production
                    options.RequireHttpsMetadata = false;

                    // Audience is api Resource name
                    options.Audience = "identityApi";
                });

            services.AddAuthorization(authorizationOptions =>
            {
                // add authorization policy from Shared project 
                // the same policy is used by the application to secure the button that calls the api.
                // This policy checks for the presence of the userApp_claim with value "identity".
                // The api also has authorization in place at the controller level provided by IdentityServer
                authorizationOptions.AddPolicy(
                    BlazorId_Shared.Policies.CanViewIdentity,
                    BlazorId_Shared.Policies.CanViewIdentityPolicy());
            });

 public void Configure(IApplicationBuilder app)
        {
            app.UseRouting();
  
            // add authentication first, followed by authorization
            //     these two should come after app.UseRouting but before app.UseEndpoints
            app.UseAuthentication();
            app.UseAuthorization();
            
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }

            services.AddAuthentication(options =>
           {
               // the application's main authentication scheme will be cookies
               options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
               
               // the authentication challenge will be handled by the OIDC middleware, and ultimately IdentityServer  
               options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
           })
               .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
               .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme,
               options =>
               {
                   options.Authority = "https://localhost:44387/";
                   options.ClientId = "BlazorID_App";
                   options.ClientSecret = "secret";
                   options.UsePkce = true;
                   options.ResponseType = "code";
                   options.Scope.Add("openid");
                   options.Scope.Add("profile");
                   options.Scope.Add("email");
                   options.Scope.Add("offline_access");

                   //Scope for accessing API
                   options.Scope.Add("identityApi"); 

                   // Scope for custom user claim
                   options.Scope.Add("appUser_claim"); 

                   // map custom user claim 
                   options.ClaimActions.MapUniqueJsonKey("appUser_claim", "appUser_claim");
                  
                   //options.CallbackPath = ...
                   options.SaveTokens = true;
                   options.GetClaimsFromUserInfoEndpoint = true;

               });

           services.AddAuthorization(authorizationOptions =>
           {
               // add authorization poliy from shared project. This is the same policy used by the API
               authorizationOptions.AddPolicy(
                   BlazorId_Shared.Policies.CanViewIdentity,
                   BlazorId_Shared.Policies.CanViewIdentityPolicy());
           });
...

 public async Task OnGetAsync()
        {
            if (!HttpContext.User.Identity.IsAuthenticated)
            {
                //Call the challenge on the OIDC scheme and trigger the redirect to IdentityServer
                await HttpContext.ChallengeAsync(OpenIdConnectDefaults.AuthenticationScheme);
            }
            else
            {
                // redirect to the root
                Response.Redirect(Url.Content("~/").ToString());
            }
        }

public async Task OnGetAsync()
        {
          // Sign out of Cookies and OIDC schemes
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);
        }