<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Markus<div class=""><br class=""></div><div class="">The question you ask is perhaps deceptively simple. I think probably most commercial iDPs should have a solution that fits your needs, but they won’t necessarily all have the same solution, depending on the exact performance / security / user experience needs. It’s probably a little hard to give much in the way of concrete advice without a lot more info about your goals.</div><div class=""><br class=""></div><div class="">The general starting position is normally that the OpenID Connect id_token contains the details of the authentication event, and the OAuth2 access token (generally issued as part of the same flow) represents the authorisation(s). (For various reasons this distinction isn’t always that clear.) The ID Token is generally expected to be consumed by the client, whereas the access token is expected to be consumed by the resource server(s) / API endpoints.</div><div class=""><br class=""></div><div class="">The simple solution is likely that your authorization server directly issues an access token that is the ‘custom authorization token containing the roles AND the per-function-grants’ (this could be a JWT/similar access token that directly contains all the details, or an opaque token that can be introspected to see what the user has access to - the latter is perhaps along the lines you describe in ‘C’, most API gateways should support token introspection as defined in <a href="https://datatracker.ietf.org/doc/html/rfc7662" class="">https://datatracker.ietf.org/doc/html/rfc7662</a> ).</div><div class=""><br class=""></div><div class="">There’s generally a lot to consider when picking your solution here, particularly as you’re likely to be stuck with whatever solution you implement for a long time - it’d probably be worthwhile to engage with the pre-sales process at a particular vendor, who should be able to give you guidance on the best way to address your use cases with their solution, or to engage with a vendor neutral consultant that could help you select the best vendor - there’s a few on the OpenID Foundation members list, <a href="https://openid.net/foundation/sponsoring-members/" class="">https://openid.net/foundation/sponsoring-members/</a> <br class=""><div><br class=""></div><div>Cheers</div><div><br class=""></div><div>Joseph</div><div><br class=""><blockquote type="cite" class=""><div class=""><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class=""> </span></div><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class="">I am new to OpenID and OAuth2 and read several tutorials and references but there is one problem left open I hope you can help with.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class="">Our existing application does RBAC with the addition of a complex system of functionality-grained access rights. This means, an authentication token must contain not only roles a user has, but also additional functionalities he is allowed to do. Example: A user that is in the role „Editor“ might have (or might not have) the additional right to execute a special function X. As our application is huge, besides lots of roles there are literally hundred of optional functionalities he could be granted or not. To our knowledge, this is not covered by any of the existing authentication services / products.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class="">We did not find a solution for this in „pure“ OpenID Connect / OAuth2, so currently we discuss the following attempts:<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><ol start="1" type="A" style="margin-bottom: 0in; margin-top: 0in;" class=""><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="DE" class="">Let OpenID Connect do ONLY Authentication but not Authorization. This means, our client sends the obtained ID Token to our existing custom authorization service in exchange for a custom authorization token containing the roles AND the per-function-grants.<o:p class=""></o:p></span></li></ol><div style="margin: 0in 0in 0in 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><ol start="2" type="A" style="margin-bottom: 0in; margin-top: 0in;" class=""><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="DE" class="">Let OpenID Connect do BOTH Authentication and Authorization, but wrap each single function-based-grant as a role. In the end, this means a token needs to contain literally hundred of roles in turn, which makes it unmanageable in literally all OpenID Connect services / products we evaluaged so far.<o:p class=""></o:p></span></li></ol><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><ol start="3" type="A" style="margin-bottom: 0in; margin-top: 0in;" class=""><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="DE" class="">Maybe there is a standardized flow that allows an authorization service dynamically lookup the function-based-grant from our custom authorization service?<o:p class=""></o:p></span></li></ol><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class="">Maybe there are other solutions to that problem, but we could not image them.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class="">Any comments welcome (besides: do not use per-function-access-rights as this is axiomatic for our product)!<span class="Apple-converted-space"> </span></span><span lang="DE" style="font-family: "Apple Color Emoji";" class="">😊</span><span lang="DE" class=""><o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class="">-Markus<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""> <o:p class=""></o:p></span></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">general mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="mailto:general@lists.openid.net" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">general@lists.openid.net</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="https://lists.openid.net/mailman/listinfo/openid-general" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://lists.openid.net/mailman/listinfo/openid-general</a></div></blockquote></div><br class=""></div></body></html>