{"action":"created","issue":{"url":"https://api.github.com/repos/thinktecture/Thinktecture.IdentityServer.v3/issues/750","labels_url":"https://api.github.com/repos/thinktecture/Thinktecture.IdentityServer.v3/issues/750/labels{/name}","comments_url":"https://api.github.com/repos/thinktecture/Thinktecture.IdentityServer.v3/issues/750/comments","events_url":"https://api.github.com/repos/thinktecture/Thinktecture.IdentityServer.v3/issues/750/events","html_url":"https://github.com/thinktecture/Thinktecture.IdentityServer.v3/issues/750","id":54151270,"number":750,"title":"Having idsvr deny Access when user doesn't have the required claim or scope","user":{"login":"parkinsona","id":8508456,"avatar_url":"https://avatars.githubusercontent.com/u/8508456?v=3","gravatar_id":"","url":"https://api.github.com/users/parkinsona","html_url":"https://github.com/parkinsona","followers_url":"https://api.github.com/users/parkinsona/followers","following_url":"https://api.github.com/users/parkinsona/following{/other_user}","gists_url":"https://api.github.com/users/parkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/parkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parkinsona/subscriptions","organizations_url":"https://api.github.com/users/parkinsona/orgs","repos_url":"https://api.github.com/users/parkinsona/repos","events_url":"https://api.github.com/users/parkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/parkinsona/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/thinktecture/Thinktecture.IdentityServer.v3/labels/feature+idea+-+discuss%21","name":"feature idea - discuss!","color":"006b75"}],"state":"open","locked":false,"assignee":{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2015-01-13T05:04:00Z","updated_at":"2015-01-18T21:43:19Z","closed_at":null,"body":"Hi,\r\n\r\nSorry if this has been covered before, but I couldn't find anything specific to my scenario.\r\n\r\nI have 2 RPs that each manage their roles separately.\r\nFor RP1 we store the role claims as RP1.Role. (Eg RP1.Role: Admin) \r\nFor RP2 we store the role claims as RP2.Role. (Eg. RP2.Role: User)\r\n\r\nIn idsvr we have 2 implicit clients setup for each RP.\r\nOne client has a scope of RP1, which includes the RP1.Role claim.\r\nthe other client has scope RP2, with RP2.Role claim.\r\n\r\nThis has been done because a user may be admin in RP1, but not necessarily in RP2.\r\n\r\nI'm unsure what will happen if a user only has role claims for RP1 and not RP2.\r\nFrom my understanding, they should be able to log in to both RPs regardless of the scopes being returned. The RPs are then responsible to restrict their pages based on the claims returned.\r\n\r\n\r\nHowever, is there a way in identity server to not log a user in to a RP if they are missing a required scope? \r\n\r\nMy concern is that someone consuming my idsvr implentation may not setup their RP roles checking correctly. In this scenario if they skip the checks, and their user doesn't have the corresponding RP role claim, they'd be allowed in when they shouldn't be.\r\n\r\nI hope that all makes sense. I did see there wasa required attribute on scope, but the description seems to suggest it won't do what I need.\r\n\"    Specifies whether the user can de-select the scope on the consent screen\"\r\n\r\nAny help would be great.\r\n"},"comment":{"url":"https://api.github.com/repos/thinktecture/Thinktecture.IdentityServer.v3/issues/comments/70427587","html_url":"https://github.com/thinktecture/Thinktecture.IdentityServer.v3/issues/750#issuecomment-70427587","issue_url":"https://api.github.com/repos/thinktecture/Thinktecture.IdentityServer.v3/issues/750","id":70427587,"user":{"login":"parkinsona","id":8508456,"avatar_url":"https://avatars.githubusercontent.com/u/8508456?v=3","gravatar_id":"","url":"https://api.github.com/users/parkinsona","html_url":"https://github.com/parkinsona","followers_url":"https://api.github.com/users/parkinsona/followers","following_url":"https://api.github.com/users/parkinsona/following{/other_user}","gists_url":"https://api.github.com/users/parkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/parkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parkinsona/subscriptions","organizations_url":"https://api.github.com/users/parkinsona/orgs","repos_url":"https://api.github.com/users/parkinsona/repos","events_url":"https://api.github.com/users/parkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/parkinsona/received_events","type":"User","site_admin":false},"created_at":"2015-01-18T21:43:19Z","updated_at":"2015-01-18T21:43:19Z","body":"When you talk about the authorization rule, do you mean the ResourceAuthorize? Where you can write your own custom implementation?"}}