Using JWT audience field for authorization roles

Question

I'm considering using the JWT audience field to implement role-based authorization in my app.

So I'd have ServiceA which requires 'RoleA' audience to be present, ServiceB requires 'RoleB' etc. Then when I issue the JWT, I include the appropriate audience(s).

Relevant section from the JWT draft spec:

The aud (audience) claim identifies the recipients that the JWT is intended for. Each principal intended to process the JWT MUST identify itself with a value in the audience claim. If the principal processing the claim does not identify itself with a value in the aud claim when this claim is present, then the JWT MUST be rejected... The interpretation of audience values is generally application specific.

So it appears that would work but since I'm new to JWT I'm wondering: is role-based authorization an appropriate use case for the audience field? Or should I roll my own logic using a payload with custom roles array etc?

Thanks

Answer 1

I understand audience rather then list of consumers/applications who can authorize the user.

In my application I put roles into own array in the payload. For example like that.

{
 "sub": 1234567890,
 "exp": 9876543210,

  "name": "John Doe",
  "roles": ["USER", "EDITOR"]
}

On the server I am authorized using spring security and user loaded from "sub".

And on the client I can use these roles to show proper buttons and fields.