Dotnet OpenId Connect change scopes at runtime

Question

I am using keycloak together with my dotnet application to handle authentication - with Keycloak 18 I want to use dynamic scopes, and by that i also need to be able to change my scope values based on the current user and actions at runtime.

The use case is that a user by selecting some options add additional scopes that needs to be evaluated by keycloak at runtime, imagine that a user selects an app and a dynamic scope named app changes based on this app: and then keycloak needs to evaluated the new scope, the user can at any time change this scope by interacting with the UI.

Currently my startup configures the authentication in AddOpenIdConnect with a number of default scopes, but i can't figure out how to dynamically change these scopes at runtime for the individual users.

user_9019885 · Answer

Scopes are values that are fixed at design time, representing an area of data and operations allowed on that data. An example might be products_read, which is the only thing your app needs to know about when managing user logins.

Claims are used when dynamic behaviour is needed. The above scope might be composed of two claims for user_type and subscription_level. These claims can be assigned different values for different users at the time of token issuance. Keycloak could collect these values via an API call or database lookup.

The end result is that the scope and both claims are issued to access tokens, and available to the backend for authorization purposes. The Claims Best Practices article has further info on this design pattern.

Dotnet OpenId Connect change scopes at runtime

1 Answers