How to properly interact Web Application and OpenId Connect?

U

username_m172021-01-08 14:09:38

Open ID

username_m17, 2021-01-08 14:09:38

Understanding OpenId Connect. Where is the right place to store user access rights to the private parts of the resource (MVC application + many Rest Api)?

1. On the resource side (the resource requests only OpenId + Profile Claims from the authentication server). Clients knock on the User Access End Point on the resource to find out if the user has rights (to the Api).
2. On the authentication server side (resource requests OpenId + Profile + App Scopes). The resource edits the user's access rights via Api.

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

I

Ivan Shumov, 2021-01-08
@username_m17

There is no right way. Both work and are used in different cases.