CODEWITHSUNDEEP
openid-connect
jung
jung

Reputation: 37

what is best way for resource authentication in openid connect

i have a web api that transfers files and checks user permissions.

Each user has read permission to the file.

eg.)

user 1 can read file1 and file2

user 2 can read file1 and file3

What's the best way to check user permissions on a file using Openid Connect in web API?

my idea :

  1. Add the all readable file name to UserClaims and send as Token.
  2. In Web API, check the permission with the file name included in Userclaims.

Upvotes: 0

Views: 287

Answers (1)

Gary Archer
Gary Archer

Reputation: 29301

When you want to authorize dynamically like this, the answer is usually to use a claim in the access token as you suggest. This might represent the owner of the file or some kind of group permission.

You may be dealing with domain specific claims here. This Claims Best Practices article discusses this type of claim and will maybe give you some ideas for your own solution.

Upvotes: 1

Related Questions