The main problem was that I put the claims in the JwtAuthenticationToken, but my OAuth2 client and resource server were in the same app with OIDC authorization and so the problem was solved after I put and view the claims from the OAuth2AuthenticationToken