I‘m writing an oauth2 authorization Server at the moment and I‘m know at a point where I need other opinions/knowledge on how to implement Scopes. I decided to do a permission system where both is required, scope and user permission. Therefore when a client tries to do an action on behalf of a user, he needs the specific scope and the user needs to have the permission to do that action. But I'm now undecided on how to do this. So my questions are:

  1. Do I need to name the scopes exactly like the permissions of the user are?
  2. Do I need to check if the user has the permission before granting the requested scope?

An example for a permission would be: account.edit.all

An the corresponding scope: account.write_all

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.