How to use OAuth scopes for authorization or enforce policies based on them?

Hello, I was playing around with authentication and authorization and wanted to quickly setup to test out some cases, when I checked the .wellknown endpoints. it mentioned the scope,
I can pass these scope while generating token but how can I use them for authorization or in permissions to generate policies? Also, where can I have fixed scope in application to check if the scope are valid?

what do you mean?

At the time of generating access_token we can pass the scope as well but there is no mean to check or check against valid list of scope. So how can we rely on scope and how can we use it against enforcing policies or defining permission ? Is there any way around or alternative. how about scope-based authorization?

don't use scope to do auth. Use Casbin

@d.mavrick.one what do you want to do

Hi @hsluoyz ,Sorry for the late reply. I want to have these permission listed in access token so that system could easily evaluate user using these permission. The only problem is access token contains the whole record of permission making it bulky and due to limitation on access token size passed via header, I couldn't send them in access token. Same case for the role as well but no so severe as it will only have one or two records per user. Could you please provide your insight? Is it a correct way to the implementing it ?
For simplicity, the steps is following:-

1. Generate access token and storage it in cookie.
2. Pass the access token in each request header to access the Back-end API resource.
3. At BE, parse the token and get the permission, match against the permission defined via an enforcer to evaluate the validity of user token.
   Does Casdoor offer any functionality to valid the access token itself against without having a BE system to parse the token for permission?

you can reduce token size in app edit page @d.mavrick.one

Could you please show me from where ?

application edit page, token type

and token fields

I need to include role and permissions and currently I have configured app for token as mentioned in image.

Please check the attachment, I have attached two JWT structure one from Token and another from /api/userinfo. I need to have similar structure just as json structure from /api/userinfo into access token as well, is it doable ?

json_token

https://casdoor.org/docs/how-to-connect/oidc-client/#oidc-userinfo-fields

userinfo has its own fields

what is the use of permissions and role list on access_token?, Do casdoor able to valid permission for user based on the access token without having to invoke enforcer manually?