Identity Server + Azure Active Directory + Blazor角色声明问题

如何解决Identity Server + Azure Active Directory + Blazor角色声明问题

我设法将Identity Server与blazor配合使用，并为本地数据库用户设置和使用了不同的用户声明，例如 role （阻止页面访问等）。然后，我成功添加了AAD连接，但是并非所有声明都被传递到id_token中的blazor应用程序。 我认为这与Blazor无关，但更多的是IS4和AAD配置问题。

这是我的IS4 startup.cs设置：

  //AAD
        services.AddAuthentication()
            .AddOpenIdConnect("aad","Sign-in with Azure AD",options =>
            {
                options.Authority = "https://login.microsoftonline.com/common";
                options.ClientId = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx";

                options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
                options.SignOutScheme = IdentityServerConstants.SignoutScheme;
                options.ResponseType = "id_token";



                options.CallbackPath = "/signin-aad";
                options.SignedOutCallbackPath = "/signout-callback-aad";
                options.RemoteSignOutPath = "/signout-aad";

                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = false,NameClaimType = "name",RoleClaimType = "role"
                };
            });

        // preserve OIDC state in cache (solves problems with AAD and URL lenghts)
        services.AddOidcStateDataFormatterCache("aad");
        //

我在config.cs中的客户端配置：

  new Client
                {
                    ClientId = "blazor",AllowedGrantTypes = GrantTypes.Code,RequirePkce = true,RequireClientSecret = false,AllowedCorsOrigins = { "https://localhost:5001" },AllowedScopes = { "openid","profile","email","backend" },AlwaysIncludeUserClaimsInIdToken=true,RedirectUris = { "https://localhost:5001/authentication/login-callback" },PostLogoutRedirectUris = { "https://localhost:5001/" },Enabled = true
                },

身份控制台日志：

[10:56:36 Debug] IdentityServer4.ResponseHandling.UserInfoResponseGenerator
Scopes in access token: openid profile backend email

[10:56:36 Debug] IdentityServer4.ResponseHandling.UserInfoResponseGenerator
Requested claim types: sub name family_name given_name middle_name nickname preferred_username profile picture website gender birthdate zoneinfo locale updated_at role email email_verified

[10:56:36 Information] IdentityServer4.ResponseHandling.UserInfoResponseGenerator
Profile service returned the following claim types: sub name preferred_username

id_token声明：

s_hash: 34563456345634563563
sid: wretqert3545643563456
sub: GUID
auth_time: 2342424324
idp: aad
name: bob Henri
preferred_username: GUID
amr: external

我希望所有要求的声明都显示在这里。

预先感谢