Understanding requirements

Question

I am trying to speed up work with OpenId Connect, OAuth2.0, the security token service and claims. Imagine a scenario with a large website with many areas and various features, for example. Customer, order, supplier, delivery, return, etc. My question is this: can I create claims on the token server such as CanCreateCustomer, CanReadCustomer, CanUpdateCustomer, CanDeleteCustomer, etc., T. e. Effectively CRUD Claims for each main area / business object? This would lead to many dozens, but rather hundreds of claims. Or is my understanding inappropriate?

Answer 1

I think your understanding is basically correct. However, if I understand what you are describing correctly, it is more likely authorization (OAuth) than an authentication problem (OIDC), and therefore you can take a look at how other OAuth resource providers define their domains (not btw claims) like GitHub or slack .

Answer 2

Your understanding is correct, but you have much more flexibility in OAuth2.0 areas (claims)

These areas can be configured in any way, for example, in your case, instead of creating separate areas for each CRUD operation for each main area, you can create group areas, such as

customer.read_write
order.read_write 

Etc, , ,

webportal.full_access
adminportal.full_access

, ,

ValidScopesIn({Scopes.WEBPORTAL_FULL_ACCESS, Scopes.CUSTOMER_READ_WRITE})
public void createCustomer(Customer customer) {
// your creation logic 
}

Answer 3

I would recommend that "areas" be configured as URIs so that no collisions occur.

As an example .

-Jeet