OpenIdConnect working with scopes to limit access to resources

Admin 1
Viewed 127

I want to implement a solution where having 2 apis which take data from one another restrict access to the exposed endpoints by scopes.

Let's say that api1 exposes two scopes. read-only and write-only. some of its endpoints will allow only one out of the two some will allow both. Same for api2.

What I don't understand is where are the scopes validated ? Or to be more specific how exactly can I limit access to my api based on the requestor allowed scopes ?

I can undersatnd that on the identity server both the api resource and client should be configured and for the client to allow it to request access for specific scopes configured for the api resource, but I'm missing some information about how to validate the scopes.

Are the allowed_scopes part of the access_token ? If so as being part of the access_token, the api resource for which the token was generated should like decript the token and get the scopes or how exactly does this process work ?

identityserver4 openid-connect oauth
1 Answers

Your thinking is on the right lines. APIs receive access tokens and authorize requests in 3 main stages:

  • First verify the digital signature of the JWT
  • Second each API endpoint verifies scopes, using the scope array received in the access token
  • Thirdly more detailed authorization is done using claims

A common way to check scopes is to use attributes on each controller method. Eg in .NET you get some help from the framework and can do this. See also this tutorial for sone other options:

    [HttpGet]
    [RequiredScope(myscope)]
    public IEnumerable<TodoItem> Get()
    {
        // Do the work and return the result.
        // ...
    }
user_90198850
Related