How to use OAuth 2.0 roles and scopes to secure services

oauth2

I have secured a REST API using OAuth 2.0 security, and I am not sure on how to configure security access using roles or scopes.

There will be three types of clients:

  • Public mobile app client used by end-users that can access their
    profile, data, etc. (using password grant type). By "public" I mean that the app is intended from any user and available to any user from Google Store, etc.)
  • Non-public administration client used only from me for administrative
    purposes that can access administrative services not allowed to be
    used by normal users (using client_credentials grant type).
  • Non-public third-party client (using client_credentials grant type) that will use some services created specifically for them.

Should I just create three different roles, User, Admin and ThirdPartyX and secure services with 'oauth2.clientHasRole' rules? Or should I create different scopes and do not care about roles? Is there a general rule of thumb on where would I use roles or scopes in general?

Best Answer

There is usually no golden right way for the problem. However, there are a few guidelines:

Use the scope request parameter as indicated in the IETF standard.

Use the claim in the JWT payload with an HMAC256 signature to verify the claims are issued by the server.

Map your roles permissions data to an RBAC database schema (but we usually use MongoDB with NoSQL).

Related Topic