{"action":"created","issue":{"url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/551","labels_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/551/labels{/name}","comments_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/551/comments","events_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/551/events","html_url":"https://github.com/brockallen/BrockAllen.MembershipReboot/issues/551","id":97447178,"number":551,"title":"Is there a recommended way to avoid \"Claims Collision\" / Applying Claims to users","user":{"login":"JellyMaster","id":4993772,"avatar_url":"https://avatars.githubusercontent.com/u/4993772?v=3","gravatar_id":"","url":"https://api.github.com/users/JellyMaster","html_url":"https://github.com/JellyMaster","followers_url":"https://api.github.com/users/JellyMaster/followers","following_url":"https://api.github.com/users/JellyMaster/following{/other_user}","gists_url":"https://api.github.com/users/JellyMaster/gists{/gist_id}","starred_url":"https://api.github.com/users/JellyMaster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JellyMaster/subscriptions","organizations_url":"https://api.github.com/users/JellyMaster/orgs","repos_url":"https://api.github.com/users/JellyMaster/repos","events_url":"https://api.github.com/users/JellyMaster/events{/privacy}","received_events_url":"https://api.github.com/users/JellyMaster/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-27T12:01:28Z","updated_at":"2015-08-07T19:28:28Z","closed_at":null,"body":"This is more a question about using MR with Identity Server. (Or just claims management in general)  \r\n\r\nWith the need for different applications to have their own specific claims and other claims to be more generic eg. cross application claims like Name, Email etc. \r\n\r\nIs there a recommended way of handling this scenario? \r\n\r\nMy current idea is to use the following: \r\nHave two classifications of claims: \r\n\r\n1) Profile/Descriptive claims e.g. FirstName, LastName, Phone etc.\r\n2) Security Claims e.g. EditAllowed, ReadAllowed, CreateNewItem etc. \r\n\r\nIn order to avoid one claim being \"mistakenly\" applied from one application to the next I am thinking of applying the following naming convention: \r\n\r\n`ApplicationName.ContextualElement.ClaimName`\r\n\r\nSo for example if we had 100 different applications they would each start off the claim name with their specific application name. e.g. `Application1.xx.yy` , `Application2.xx.yy`, `Service1.xx.yy` etc. \r\n\r\nThen the second element would be a contextual identifier such as Profile, Security, General etc. \r\n\r\nThe final element would be the actual claim e.g. ProfileEdit, UpdateRecords etc. \r\n\r\nNow in order to manage Access Rights more easily I have two ideas: \r\n\r\n1) Add any new security rights (security claims) to all users and have disabled by default, then explicitly apply `Allowed` access. \r\n2) Only Add security rights as and when allowed access is granted. \r\n\r\nIn my current non-ids solution I am using option **2** but I wonder if option 1 is the right way to go as this then ensures all my users have all the security claims added and then it is a simple case of switching them on and off within my User Management system rather than having to remember which users have access to these rights. \r\n\r\nMy only concern with Option 2 is that the cookie being generated could get very large. I guess the way round this would be to have a \"basic\" cookie and then do a check on the server everytime for the appropriate access (although would this introduce more issues with network overhead/ performance issues) using this \"remote\" checking solution for every security right would allow for security changes to be registered straight away without the user needing to log out and back in again. \r\n\r\nSo I guess this is more a open question to the community and just wondering what others are doing in this situation. \r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/comments/128802539","html_url":"https://github.com/brockallen/BrockAllen.MembershipReboot/issues/551#issuecomment-128802539","issue_url":"https://api.github.com/repos/brockallen/BrockAllen.MembershipReboot/issues/551","id":128802539,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2015-08-07T19:28:28Z","updated_at":"2015-08-07T19:28:28Z","body":"In IdSvr 2.0.0 we've added the client ID making the token request to the user service get get profile API. This allows you to decide what claims to return to which client.\r\n\r\nAs for the storage of the claims and how they map to clients -- yea, MR doesn't have that concept, so your naming convention might just be as good as anything."}}