In our setup we need both reliable user authentication and scope-based authorization.

Consider the following scenario: a user logs in into our client (portal) using OpenID Connect, and our client wants to access a resource ("read") on a resource server (exposed by a backend service API) on a different server that is protected via OAuth 2.0.

Would it be a legitimate approach to add a custom "read" scope to OpenID Connect and use the received access(!) token to access a protected API requiring the "read" scope?


1 Answer 1


To answer my own question. Yes, it is legitimate to do that. We use OIDC for authentication and the access_token to protect the APIs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.