OAuth and OpenID confusion regarding claims and access - oauth-2.0

Question

I checking how to use IdentityServer4 as I have heard about it a lot. I am trying to make my concepts clear but I am confused:
Access Token: It contains claims that can be used to restrict API access, it contains client info with a token.
Id token: It contains identity info of user, it cannot be used to restrict access to API but it can be used to pass user info just by a token.
I have few questions:
What is difference between ApiResources and IdentityResources?
What is the difference between ApiClaims, ApiScopeClaim and IdentityClaims? And, when and where they are used?
Thanks

Answer 1

Firstly, access tokens do not contain claims.
It is just a JWT token with no claims. You might want to check out the openID specification document. But in short,
Relying Party makes a GET Request to the Token Endpoint which looks something like this:
POST /token/HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-url-encoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
grant_type=authorization_code&code=xxxxxxxxxx&redirect_URI=https%3A%2F%2Fclient.example.org%2Fcb
The identity Server should return a response like this:
HTTP/1.1 200 OK
Content-Type: application/json
Cache control: no-store
Pragma: no-cache
{
"access_token": "S1AV32hKG",
"token_type" : "Bearer",
"refresh_token": "xxxxxxxxxxx",
"expires_in": 3600,
"id_token": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
As you see the server responds with an access token that can be used to make a request to the userinfo endpoint which contains claims about the user. Claims are nothing but more information regarding the resource owner.
This should be the userinfo endpoint response:
HTTP/1.1 200 OK
Content-Type: application/json
{
"sub": "248289761001",
"name": "Jane Doe",
"given_name": "Jane",
"family_name": "Doe",
"preferred_username": "j.doe",
"email": "janedoe#example.com",
"picture": "http://example.com/janedoe/me.jpg"
}
Read http://openid.net/specs/openid-connect-core-1_0.html#UserInfoRequest for more information