what is the use of permissions and role list on access_token?, Do casdoor able to valid permission for user based on the access token without having to invoke enforcer manually?
I need to include role and permissions and currently I have configured app for token as mentioned in image.
Please check the attachment, I have attached two JWT structure one from Token and another from /api/userinfo. I need to have similar structure just as json structure from /api/userinfo into access token as well, is it doable ?
json_token
Could you please show me from where ?
Hi @hsluoyz ,Sorry for the late reply. I want to have these permission listed in access token so that system could easily evaluate user using these permission. The only problem is access token contains the whole record of permission making it bulky and due to limitation on access token size passed via header, I couldn't send them in access token. Same case for the role as well but no so severe as it will only have one or two records per user. Could you please provide your insight? Is it a correct way to the implementing it ?
For simplicity, the steps is following:-
- Generate access token and storage it in cookie.
- Pass the access token in each request header to access the Back-end API resource.
- At BE, parse the token and get the permission, match against the permission defined via an enforcer to evaluate the validity of user token.
Does Casdoor offer any functionality to valid the access token itself against without having a BE system to parse the token for permission?
At the time of generating access_token we can pass the scope as well but there is no mean to check or check against valid list of scope. So how can we rely on scope and how can we use it against enforcing policies or defining permission ? Is there any way around or alternative. how about scope-based authorization?
