OpenID Connect with user bound roles and M2M access
I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. However, I'm trying to get my head around how I should handle the cases where i want M2M access to all resources, and a end user should only have access to his/her data.
My question is more related to how I should handle roles, is it overkill to have roles such as:
- view_company_data
- view_all_data
An example could be to provide a public API to access all data, e.g. collaborating companies, while also allowing me to have specific users to only access the data created by him/her. In my case that would be government body that wants access to all data, whilst the business owners should only have access to their own data.
I have an authentication provider, along with several resource servers. The business owners access their data through our client with only read/write permission for their own entity, and the government body wants access through our APIs to access all the data.
I wish to have all access control in a central entity, so generating access tokens on each separate resource server along with default JWT tokens from the authentication server seems like a bad idea. I'd rather handle it all from the authentication server.
Also a user should be able to generate these full-access tokens, given that they have an Global administration role.
So, what would be the right thing to do here?
