{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1867","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1867/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1867/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1867/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1867","id":105758492,"number":1867,"title":"Enforcing authorization of Web Apis","user":{"login":"indranilatcal","id":5689039,"avatar_url":"https://avatars.githubusercontent.com/u/5689039?v=3","gravatar_id":"","url":"https://api.github.com/users/indranilatcal","html_url":"https://github.com/indranilatcal","followers_url":"https://api.github.com/users/indranilatcal/followers","following_url":"https://api.github.com/users/indranilatcal/following{/other_user}","gists_url":"https://api.github.com/users/indranilatcal/gists{/gist_id}","starred_url":"https://api.github.com/users/indranilatcal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/indranilatcal/subscriptions","organizations_url":"https://api.github.com/users/indranilatcal/orgs","repos_url":"https://api.github.com/users/indranilatcal/repos","events_url":"https://api.github.com/users/indranilatcal/events{/privacy}","received_events_url":"https://api.github.com/users/indranilatcal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-10T08:28:26Z","updated_at":"2015-09-10T11:54:13Z","closed_at":null,"body":"Hi\r\n\r\nI need to enforce authorization checks for web apis based on claims issued by the identityserver. I've had a look at the 'Getting Started: MVC Authentication & Web APIs' sample, but there, all the authorization seems to be done within the client application. Is it possible to do something similar in the 'protected Web Api'? In this sample, all that protects the web api is its required scope. Is that the only protection possible or we can go to deeper levels as it has been illustrated in the client app in this example? The packages used for authorization are prefixed with Thinktecture, but I suppose I read somewhere that version 2.x of identity server has gotten rid of Thinktecture from the packages, but I don't seem to find a nuget package that deals with Authorization that is devoid of Thinktecture."},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/139212906","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1867#issuecomment-139212906","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1867","id":139212906,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2015-09-10T11:54:13Z","updated_at":"2015-09-10T11:54:13Z","body":"Yes, you have the claims for the request (User, Client, Scopes in the access token) in the Web Api so you will can do the necessary authorization checks."}}