Can Authorize API by scope in identityserver3?

Question

I'm very new in Identityserver and as far as I know scopes are identifiers for resources that a client wants to access and I’m wondering if I can Authorize my API by scope? For Ex: I have 2 APIs "Employee" and "student" To CRUD employee and student, Client require scope "Employee" for APIs Employee and get access token => Client will be able to use API Employee but will be reject by Identityserver if use API "Student" because no request scope "student" How can I do that will IdentityServer ? Thanks

Answer 1

When the access token is presented to the API and you use the IdentityServerAccessTokenValidation middleware to validate it, then the scopes in the access token are expressed as claims in the User's claims collection. For authorization you can then check for the scope required and issue a 403 if the scope is not present.