Don't include the OpenIddict private claims in the merged principal

src/OpenIddict.Client/OpenIddictClientHandlers.cs

@@ -4061,6 +4061,12 @@ public static partial class OpenIddictClientHandlers
                             continue;
                         }
 
+                        // Ignore the OpenIddict private claims.
+                        if (claim.Type.StartsWith(Claims.Prefixes.Private, StringComparison.OrdinalIgnoreCase))
+                        {
+                            continue;
+                        }
+
                         identity.AddClaim(claim);
                     }
                 }