One thing related to OAuth 2.0 and JWTs that's still a bit confusing is when to use scopes vs. roles.
I think some of the confusion is coming from how role-based authorization works in ASP.NET Core (which is the primary language/framework at my workplace). For example; if I have roles in my JWT as follows
{
"aud": "test",
"iss": "http://localhost:8080/auth/realms/test/",
"iat": 1585192274,
"nbf": 1585192274,
"exp": 1585196174,
"sub": "12345",
"roles": ["Admin", "SuperUser"]
}
I can protect routes quite easily without having to do much e.g:
[ApiController]
[Route("api/v{version:apiVersion}/template/test")]
public class TestController : Controller
{
[HttpGet]
[Authorize(Roles = "Admin")]
public IActionResult Get()
{
return Ok("test");
}
}
I could implement something very similar to the above using scopes with dotnet authorization policies, but I'd just like to know if there's some guidance about if/when to use scope or roles, or is it simply a matter of preference...
I can't find much reference to the roles claim in any of the OAuth/JWT-related RFCs, whereas scopes are mentioned throughout.