I'm trying to work out how best to secure an API using oAuth scopes and/or claims. I'm unsure on which I should be using.
My setup is as follows:
All users sign in to
There are multiple clients
There is one resource server
There are multiple scopes
www.domain.comrequests one scope
admin.domain.comrequests both scopes
Some users who are administrations need to be able to write data (e.g. POST to api.domain.com) but all authenticated users can read.
As I understand it, users signing in using client
www.domain.com will not be issued a token containing the scope
data.write even if the client requests it.
I have read that scopes are kind of categories of claims . Does this mean that if a client requests a specific scope I need to populate the token with all the claims related to that scope?
From there does my resource server check if the user has the correct claim?
Or, does the resource server just check that the token has the correct scope in it?
Either way, it is not possible to assign scopes to users, only to clients and it is not enough to say "user signed in through client x so they get write permission." So it would seem my first assumption seems the only correct one.
I would be grateful if anyone can clarify how scopes and claims should be used to provide granular API access,