Oauth2, scopes and user roles : <p>I am asking a question conceptually here as I am trying to understand the relationship between scopes and user roles in an OAuth2 based system. </p>

<p>As I am implementing an API, I want to restrict access to specific resources by using scopes on the resources. I understand the use of access tokens to request resources, and I believe my understanding to be correct in that you specify your scope(s) when requesting the access token.</p>

<p>What I am not entirely sure of is how restriction of scopes would work based on specific roles that an authenticated user is in. Let's assume Bob is an admin and Sue is a regular user. We have some resources protected by an <em>is_admin</em> scope. What stops Sue from requesting (and receiving) <em>is_admin</em> scope in her access token?</p>

<p>I am <em>thinking</em> that what should happen is the following:</p>

<ul>
<li>Bob authenticates.</li>
<li>Bob's roles are looked up after his authentication is complete. His "admin" role has the "is_admin" scope attached.</li>
<li>Bob asks for an access token with all the scopes collected from his various roles</li>
<li>Bob is automatically given those scopes for his access token</li>
</ul>

<p>Is it up to my calling app to enforce only sending asking for the scope Bobs needs? Or is there something I am missing with regards to scopes?</p>

<p>Can someone please enlighten me with some simple examples?</p>
