In our setup we need both reliable user authentication and scope-based authorization.
Consider the following scenario: a user logs in into our client (portal) using OpenID Connect, and our client wants to access a resource ("read") on a resource server (exposed by a backend service API) on a different server that is protected via OAuth 2.0.
Would it be a legitimate approach to add a custom "read" scope to OpenID Connect and use the received access(!) token to access a protected API requiring the "read" scope?