I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using.

My setup is as follows:

  • All users sign in to signin.domain.com

  • There are multiple clients www.domain.com and admin.domain.com

  • There is one resource server api.domain.com

  • There are multiple scopes data.read and data.write

  • www.domain.com requests one scope data.read and admin.domain.com requests both scopes data.read and data.write

  • Some users who are administrations need to be able to write data (e.g. POST to api.domain.com) but all authenticated users can read.

As I understand it, users signing in using client www.domain.com will not be issued a token containing the scope data.write even if the client requests it.

I have read that scopes are kind of categories of claims [1]. Does this mean that if a client requests a specific scope I need to populate the token with all the claims related to that scope?

From there does my resource server check if the user has the correct claim?

Or, does the resource server just check that the token has the correct scope in it?

Either way, it is not possible to assign scopes to users, only to clients and it is not enough to say "user signed in through client x so they get write permission." So it would seem my first assumption seems the only correct one.

I would be grateful if anyone can clarify how scopes and claims should be used to provide granular API access,


[1] https://www.quora.com/What-is-the-differences-between-scope-and-claims-in-OpenID-Connect-specification

  • You might find oauth.net/articles/authentication useful - in short, though, it sounds like you're conflating authorisation and authentication. – Matthew Nov 19 '18 at 14:46
  • Thanks will take a look. I guess all of the above could be boiled down to "Should I authorise with claims or scopes". This really comes from using AWS API Gateway where you can permit access to an API based on scopes. – Remotec Nov 19 '18 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.