22

I've read the IdentityServer4 documentation but I can't understand what is the exact difference between these three concepts. (ApiResource vs ApiScope vs IdentityResource)

1- As it is said in the documentation, API Scope models an OAuth scope. and API Resource models an API resource. So what is the difference between the OAuth scope and API resource?

2- also, as I understand in this section of document , in AllowsScope of client definition in Identity server, we must add IdentityResources. So what is the exact usage of Identity resources?

3- If I add some IdentityResources to client AllowsScopes, How can I see these Resources In client?

I am the beginner in Identity Server, which means that my questions are maybe elementary. but please answer it, I've searched a lot, and nowhere explain these concepts completely. For example,here is the definition of Identity resource!

Happy Developer
  • 617
  • 1
  • 8
  • 15

1 Answers1

41

Scopes listed under IdentityResources are the scopes that will be included in the ID token.

ApiScopes is what you ask for as a client and as a user, you give consent to. Optionally, one or more ApiResources can be associated with an ApiScope.

The ApiScope and ApiResources control what is included in the access token. ApiResources points out what the aud claim in the access token will contain.

To summarize, the scopes sent by the client are a list of IdentityResources and ApiScopes.

enter image description here

To complement this answer, I wrote a blog post that goes into more detail about this topic: IdentityServer – IdentityResource vs. ApiResource vs. ApiScope

Tore Nestenius
  • 16,431
  • 5
  • 30
  • 40
  • 3
    As I read the documents here, it is the opposite of what you said, ApiResource, can point out one or more ApiScope. Am I right? https://identityserver4.readthedocs.io/en/latest/topics/resources.html#api-resources – Happy Developer Sep 12 '20 at 05:21
  • also I have another question, I add "email" to allowed scopes of client, and also add it in identity resources, then add it to client scope by add.scope("email). but when i decrypt the IDToken can't see email value in it. (also the users claims has "email") – Happy Developer Sep 12 '20 at 07:02
  • Yes you are right! but (the arrows are in the wrong direction) but from a user point of view, you ask for ApiScopes and then they point out ApiResources to include. – Tore Nestenius Sep 12 '20 at 07:26
  • Regarding email, did you also add email to the client allowedscopes list? – Tore Nestenius Sep 12 '20 at 07:27
  • 2
    i clarified the text and image, logically , one ApiScopes includes zero or more ApiResources. But in code an ApiResource selects to which ApiScopes they belong to. – Tore Nestenius Sep 12 '20 at 07:41
  • I can't understand what is the difference between logic and code. why one ApiScope includes zero or more ApiResource logically? could you please explain it more? does this image wrong? https://imgur.com/a/kjDUD02 – Happy Developer Sep 14 '20 at 07:31
  • regarding email, yes I've add email to client allowedscope list.. – Happy Developer Sep 14 '20 at 07:32
  • A user never asks access to a ApiResource directly (it was like like that in version 3.x), in V4 of IdentityServer, a user asks for ApiScopes when they ask for scopes. So, a user asks for access and give consent for a set of IdentiyResources and ApiScopes. Then to control what goes into the audience claim, is determined how many ApiResources is tied to the ApiScope. – Tore Nestenius Sep 14 '20 at 11:42
  • so , one ApiResource contains one or more ApiScope? – Happy Developer Sep 15 '20 at 05:36
  • does this image correct? https://imgur.com/a/kjDUD02 – Happy Developer Sep 15 '20 at 05:37
  • image is correct, so each ApiResource points out what Scope they want to be associated with. Does that make this question accepable? – Tore Nestenius Sep 15 '20 at 06:26
  • yes ! :D but I want to ask you to put this image or something like this in your answer for other developers. your exact answers does not say exact relation between these two concept. (The Identity resource is explained well) – Happy Developer Sep 15 '20 at 07:30
  • I think my picture is pretty clear, its not that the ApiResorces owns the ApiScopes, the ApiScopes in the ApiResource is just the names of the scopes, not the apiObject scopes them self.... In my picture, the ApiResource Payment is tied to the ApiScope Payment. – Tore Nestenius Sep 15 '20 at 11:17
  • An arrow between Resource and Scope is not a clear explanation. That's why I said put more shape.Your figure does not explain exactly what the arrow means – Happy Developer Sep 15 '20 at 12:16
  • 1
    I fixed an arrow bug and also added scopes, happy? – Tore Nestenius Sep 15 '20 at 12:37
  • it's confusing between scope and ApiScope. It looks like they're different things, why are they called the same name? – liang Jan 06 '21 at 06:46
  • 2
    Scope is what you as a client ask for, then the scope mapped to the identityresources and the ApiScopes. In other words, the scope is a list of IdentityResources and ApiScopes. – Tore Nestenius Jan 06 '21 at 09:07