How can I get permissions into my scope in the access token?

[mathiasconradt]

Any other thoughts?

The other way is to change the JWT Authorizer class on resource server side and let it check the permissions claims instead of scope claim. Not sure about AWS and what they offer, but I assume they allow custom authorizers.

I could have separate HTTP APIs for admin and regular user functionality

How do these roles relate to scope and permissions claim in your scenario? Asking because you didn’t mention them in the initial post. Do these user roles make the authorization request in a different way, or does RBAC only apply to one of them?

---

Related resources:

On The Nature of OAuth2’s Scopes

What is the difference between scopes and permissions?

Question: What is the difference between scopes and permissions? Answer: What are scopes? From the OAuth2 spec: The authorization and token endpoints allow the client to specify the scope of the access request using the “scope” request parameter. In turn, the authorization server uses the “scope” response parameter to inform the client of the scope of the access token issued. The value of the scope parameter is expressed as a list of space- delimited, case-sensitive strings. The str…