OpenID Connect access token to access protected API

Question

In our setup we need both reliable user authentication and scope-based authorization.

Consider the following scenario: a user logs in into our client (portal) using OpenID Connect, and our client wants to access a resource ("read") on a resource server (exposed by a backend service API) on a different server that is protected via OAuth 2.0.

Would it be a legitimate approach to add a custom "read" scope to OpenID Connect and use the received access(!) token to access a protected API requiring the "read" scope?

Answer 1

To answer my own question. Yes, it is legitimate to do that. We use OIDC for authentication and the access_token to protect the APIs.