What is scope in IdentityServer

Scope

It's safe to say that Scope is kind of a role to access a specific set of resources IMHO. IdentityServer has two scope types, the ScopeType enum is defined and described as 'OpenID Connect scope types.'

• Identity Scope : representing identity data (e.g. profile or email)
• For example, if you have a profile identity scope, then clients with this scope can get the profile data from an identity provider ( e.g. IdentityServer )
• Resource Scope : representing a resource (e.g. a web api)
• For example, if clients have a calendar resource scope, then they can call a /get/calendar/months web api and get the resources.

Scope will be included in Claim when a HTTP request with an access token is in flight and will be further validated at the validation stage for the access token.

Of course the client should be added prior to running IdentityServer and proper scopes should be specified in AllowedScopes; a member of the Client class in IdentityServer.

The better resource to know about oAuth2 is IETF, and about OpenID Connect is openid.net.

IdentityServer is an implementation of OAuth2 and OpenID so it's documentation will not cover the basics that related to OAuth2 and OpenID.

To understand first about scopes you should have a clear understanding about clients.

Client: Models an OpenID Connect or OAuth2 clients (not your client application) and it should have a clear flow for example you defined a client which uses implicit flow.

The flow is the way that you should follow in order to get the needed data for example access_token and id_token.

All flows can be used with any cases but there are recommended flows for every case.

For example, up until now, it was recommended that you use implicit flow with native and javascript clients. Though, recently this has been changed to Authorization Code with PKCE. See Identity Server's blog post on this change to IETF/OpenID recommendations

Scopes: Models an OpenID Connect (Identity scopes like email, given_name etc.) or OAuth2 (Resource scopes like your WebApi that you want to protect it's data) scopes.

You can think about scopes as intent of the client, for example: The Client ask you to use your resource owner to grant me access to your openid scopes > given_name, email & prefered_username and your OAuth2 scope > WebApi.

For full understanding:

1- Pluralsight - Building and Securing a RESTful API for Multiple Clients in ASP.NET

2- Pluralsight - OAuth2 and OpenID Connect Strategies for Angular and ASP.NET