13

I need to implement SSO on our web API and I was reading about OpenID and IdentityServer. This is my first connection with SSO, OAuth and OpenID.

In the presentation movies I heard a lot about scopes and claims, but the presenter never explained what each one of these actually means. I went to the official site and searched there, but I didn't find a definition of the terms.

So, what exactly is a scope and what is a claim?

11

Claims are specific attributes about a user. Wiki defines it as "A claim is a statement that one subject, such as a person or organization, makes about itself or another subject. For example, the statement can be about a name, group, buying preference, ethnicity, privilege, association or capability. ".

Source: Wiki

A scope is an indication by the client that it wants to access some resource, your server may allow or reject this. Oracle - Oauth Scopes

To provide an example, in your application your user may have a name, email and company name - these are your claims. That client may request access to your Admin controller of your Web API, this would be a scope. In an SSO environment, it could be some other application in its own right such as another API.

Google use scopes to control access to data transfer / analytics / ads APIs Google Oauth Docs

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.