How to use IdentityServer4 scopes in resource api

Question

I am creating an api resource in my identityserver application:

new ApiResource
{
    Name = "socialnetwork",

    Scopes =
    {
        new Scope()
        {
            Name = "socialnetwork.read_contents",
            DisplayName = "Read"
        },
        new Scope
        {
            Name = "socialnetwork.share_content",
            DisplayName = "Write"
        }
    }
}

But how can I use this scopes in my socialnetwork api controllers.

public class SocialController : Controller
{
   [HttpGet]
   public async Task<IActionResult> GetCotntents(){

   }

   [HttpPost]       
   public async Task<IActionResult> ShareCotntents(string content){

   }
}

• If a client has socialnetwork.read_contents scope, it can access GetCotntents() method.
• If a client has socialnetwork.share_content scope, it can access ShareCotntents() method.

Actually does scope purpose is this? And how can I use it?

Answer 1

I believe that what you need to do is set up a policy for each scope you want to use (in your ConfigureServices)

 services.AddAuthorization(x =>
            {
                x.AddPolicy("readcontents", policy => 
                  policy.RequireClaim("scope", "socialnetwork.read_contents"));
                x.AddPolicy("shared", policy => 
                 policy.RequireClaim("scope", "socialnetwork.share_content"));
            });

Add then you can mark the Authorize attribute on your api method with the policy

   [HttpGet]
   [Authorize("readcontents")]
   public async Task<IActionResult> GetCotntents(){

   }

  [HttpPost]      
  [Authorize("shared")] 
  public async Task<IActionResult> ShareCotntents(string content){

  }