I am a developer who's just starting to learn about authorization and authentication for web apps. I am bit unclear on the concept of managing access control to parts of the app, and where is the best place to have access control managed, given the plethora of third-party authorization services like AD or Auth0.
For instance, let's say I have an eCommerce website, and I use Azure's Active Directory (AD) to manage my users login. Several parts of the website include, say, items management, category management, and promotion management. Some roles could be, "item manager" - who's able to see and modify items, a "marketing executive", who will be able to see and modify promotions, and a superadmin, who can do anything.
Is it a good practice to have the role and access management available directly inside the app? So if a superadmin would like to create a new role, who has both access to item and promotion management, they can create the role inside the app and assign it to users. The back-end then would directly go to AD and create a new role. Is this even possible?
Alternatively, should all these roles be managed directly inside AD? If so, what would happen as the application grows and have extensions of functionalities - would developers then need to add new claims to the existing roles every time they develop something?