public static IEnumerable<ApiResource> GetApiResources(IConfiguration configuration)
    {
        return new []
        {
            new ApiResource
            {
                Name = "invoices.api",

                ApiSecrets =
                {
                    new Secret("invoices.api.secret".Sha256()),
                },

                Scopes =
                {
                    new Scope("invoices.api.scope"),
                },

                UserClaims =
                {
                    "custom_role",
                }
            }
        };
    }

    public static IEnumerable<Client> GetClients(IConfiguration configuration)
    {
        return new []
        {
            new Client
            {
                ClientId = "invoices.ui",
                RequireConsent = false,
                AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                AccessTokenType = AccessTokenType.Reference,

                AllowedCorsOrigins = configuration.GetSection("Redirect").Get<RedirectOptions>().AllowedCorsOrigins.ToList(),
                RedirectUris = configuration.GetSection("Redirect").Get<RedirectOptions>().RedirectUris.ToList(),
                PostLogoutRedirectUris = configuration.GetSection("Redirect").Get<RedirectOptions>().PostLogoutRedirectUris.ToList(),

                ClientSecrets =
                {
                    new Secret("invoices.ui.secret".Sha256())
                },

                AllowedScopes =
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    "invoices.api.scope",
                },
            }
        };
    }

    public static IEnumerable<TestUser> GetUsers(IConfiguration configuration)
    {
        return new []
        {
            new TestUser
            {
                SubjectId = "1",
                Username = "alice",
                Password = "123",
                Claims =
                {
                    new Claim("custom_role", "user"),
                },
            },
            new TestUser
            {
                SubjectId = "2",
                Username = "bob",
                Password = "123",
                Claims =
                {
                    new Claim("custom_role", "admin"),
                },
            }
        };
    }

    public static IEnumerable<IdentityResource> GetIdentityResources(IConfiguration configuration)
    {
        return new []
        {
            new IdentityResources.OpenId(),
        };
    }

services.AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = "oidc";
    })
    .AddCookie(opts =>
    {
        //opts.ExpireTimeSpan = TimeSpan.FromSeconds(60);
    })
    .AddOpenIdConnect("oidc", opts =>
    {
        opts.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;

        opts.DisableTelemetry = true;

        opts.Authority = Configuration.GetValue<string>("IdentityServer");
        opts.RequireHttpsMetadata = false;

        opts.ClientId = "invoices.ui";
        opts.ClientSecret = "invoices.ui.secret";
        opts.ResponseType = "code id_token";

        opts.SaveTokens = true;
        opts.GetClaimsFromUserInfoEndpoint = true;

        opts.Scope.Clear();
        opts.Scope.Add("openid");
        opts.Scope.Add("invoices.api.scope");
    });

@foreach (var claim in User.Claims)
    {
        <dt>@claim.Type</dt>
        <dd>@claim.Value</dd>
    }