.AddJwtBearer(options =>
        {
          options.TokenValidationParameters = tokenValidationParameters;
          options.Events = new JwtBearerEvents {OnTokenValidated = OnTokenValidated};
        });

      return services;
    }

    private static Task OnTokenValidated(TokenValidatedContext ctx)
    {
      var roles = ctx.Principal.Claims.FirstOrDefault(x => x.Type == "custom:roles");

      if (!string.IsNullOrWhiteSpace(roles?.Value))
      {
        var claims = roles.Value.Split(",")
          .Select(x => new Claim(ClaimTypes.Role, x))
          .ToList();

        var appIdentity = new ClaimsIdentity(claims);
        ctx.Principal.AddIdentity(appIdentity);
      }

      return Task.CompletedTask;
    }