HomeRealms - Per client restrictions? about identityserver3 HOT 7 CLOSED

Well - there is nothing like that implemented right now. We are thinking about it.

But if we would implement that, that would be a per client setting - not per user.

from identityserver3.

I would think per-client makes more sense than per user anyway.

Apologies for the questions, but I'm just struggling at the minute around how to have 2 publicly available un-restricted web urls, sharing the same idP, but with different rights granted to the users of each application (client). Without accidentally granting the 'wider' rights to the wrong user population. I had thought tenancy might be the way to go, but now I'm thinking that there is no 'automatic' way to do what I want, and that I'll have to have an administration role to explicitly add that scope/claim/role etc. to the relevant users.

from identityserver3.

Again scope is a client setting - not for users.

from identityserver3.

But you can issue different claims based on user/client/scope information - have a look at the DefaultClaimsProvider class

from identityserver3.

Yes, I think that's the way I have to go. A pre-existing user who has the right to do so needs to add to any relevant newly created users the claim to use the 'private' (but publicly available) web url. Would this be a 'common' approach ?

from identityserver3.

Well - that's up to your user management piece - the relevant claims would be in the DB - and the claims provider would put them in the token.

from identityserver3.

Yup, I get that's how I'd do it technically, I mean philosophically :) I think I'm happy with this approach, thank you so much for your time and effort on these tools! 👍

from identityserver3.