IdentityServer4 QuckStart 授权与自定义Claims的问题

[Route("api/[controller]")]
[Authorize(Roles = "Administrator")]
[ApiController]
public class UserInfoController : ControllerBase
{
 /// <summary>
 /// 无参GET请求
 /// </summary>
 /// <returns></returns>
 [HttpGet()]
 [ProducesResponseType(typeof(ReturnData<IEnumerable<UserInfo>>), Status200OK)]
 public async Task<ActionResult> Get()
 {
 var info = new Info<UserInfo>();
 return Ok(new ReturnData<IEnumerable<UserInfo>>(await info.Get()));
 }

{
 "nbf": 1587301921,
 "exp": 1587305521,
 "iss": "http://localhost:5000",
 "aud": "MonitoringSystemApi",
 "client_id": "webClient",
 "sub": "c6c18d4d-c28e-4de5-86dd-779121216204",
 "auth_time": 1587301921,
 "idp": "local",
 "scope": [
 "roles",
 "MonitoringSystemApi",
 "offline_aess"
 ],
 "amr": [
 "pwd"
 ]
}

public static IEnumerable<IdentityResource> Ids =>
new List<IdentityResource>
{
 new IdentityResources.OpenId(),
 new IdentityResources.Profile(),
 new IdentityResource ("roles", new List<string> { JwtClaimTypes.Role }){ Required = true}
};

public static IEnumerable<Client> Clients =>
 new List<Client>
 {
 new Client
 {
  ClientId = "webClient",
  ClientSecrets = { new Secret("secret".Sha256()) },
  AllowOfflineAess = true,
  AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
  // scopes that client has aess to
  AllowedScopes = {
  "roles",

  "MonitoringSystemApi" }
 },

//添加用户代码
bob = new ApplicationUser
{
 UserName = "bob"
};
var result = userMgr.CreateAsync(bob, "Pass123$").Result;
if (!result.Sueeded)
{
 throw new Exception(result.Errors.First().Description);
}
result = userMgr.AddClaimsAsync(bob, new Claim[]{
new Claim(JwtClaimTypes.Role, "Administrator"),
new Claim(JwtClaimTypes.Name, "Bob Smith"),

public static IEnumerable<ApiResource> Apis =>
new List<ApiResource>
{
 new ApiResource("pls", new[]{ "role"}),
};

public static IEnumerable<Client> Clients =>
new List<Client>
{
new Client
{
 ClientId = "webClient",
 ClientSecrets = { new Secret("secret".Sha256()) },
 AllowOfflineAess = true,
 AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
 // scopes that client has aess to
 AllowedScopes = {
 "pls"
 }
},

{
 "nbf": 1587301799,
 "exp": 1587305399,
 "iss": "http://localhost:5000",
 "aud": "pls",
 "client_id": "webClient",
 "sub": "c6c18d4d-c28e-4de5-86dd-779121216204",
 "auth_time": 1587301799,
 "idp": "local",
 "role": "Administrator",
 "scope": [
 "pls",
 "offline_aess"
 ],
 "amr": [
 "pwd"
 ]
}