How to authorize different roles on a .Net 5 OAuth API

Question

I have an IdentityServer4 application, a client application and a .Net 5 API. I want the client application to be able to talk to my API on the users behalf with an access token. Some users should be able to do admin requests while others should only be able to do normal user tasks.

I believe I need to add two scopes for these, api.admin and api.normal.

First question is where would I add these scopes in identityserver? Does the client request both scopes and just gets back whatever IS decides is right for that user?

Secondly, how do I validate what scopes are in the access token on my API. Method 1 should only be used if the access token contains the api.admin scope for eg.

Thanks!

Answer 1

First, scopes are something you typically hard-code in your client and it does not "vary" between users. It main purpose is to indicate what the "client" application want to have access to, not the user.

So you only need only one scope like "api".

Then you have different roles or claims in the access-token that describe what the authenticated user have access to.

You then use the authorization middleware in the API to determine what the user actually have access to.

Like what the picture below shows: