{"action":"opened","issue":{"url":"https://api.github.com/repos/IdentityModel/Thinktecture.IdentityModel/issues/167","repository_url":"https://api.github.com/repos/IdentityModel/Thinktecture.IdentityModel","labels_url":"https://api.github.com/repos/IdentityModel/Thinktecture.IdentityModel/issues/167/labels{/name}","comments_url":"https://api.github.com/repos/IdentityModel/Thinktecture.IdentityModel/issues/167/comments","events_url":"https://api.github.com/repos/IdentityModel/Thinktecture.IdentityModel/issues/167/events","html_url":"https://github.com/IdentityModel/Thinktecture.IdentityModel/issues/167","id":172829853,"number":167,"title":"authorize based on ScopeClaim value","user":{"login":"engenb","id":2085828,"avatar_url":"https://avatars.githubusercontent.com/u/2085828?v=3","gravatar_id":"","url":"https://api.github.com/users/engenb","html_url":"https://github.com/engenb","followers_url":"https://api.github.com/users/engenb/followers","following_url":"https://api.github.com/users/engenb/following{/other_user}","gists_url":"https://api.github.com/users/engenb/gists{/gist_id}","starred_url":"https://api.github.com/users/engenb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/engenb/subscriptions","organizations_url":"https://api.github.com/users/engenb/orgs","repos_url":"https://api.github.com/users/engenb/repos","events_url":"https://api.github.com/users/engenb/events{/privacy}","received_events_url":"https://api.github.com/users/engenb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-23T23:18:20Z","updated_at":"2016-08-23T23:18:20Z","closed_at":null,"body":"Hello,\r\n\r\nI have a JWT that looks kinda like this (I omitted irrelevant stuff):\r\n\r\n```json\r\n{\r\n  \"client_id\": \"00000000-0000-0000-0000-000000000003\",\r\n  \"scope\": [\r\n    \"openid\",\r\n    \"profile\",\r\n    \"api\"\r\n  ],\r\n  \"sub\": \"0b86dc73-9cd1-4cd5-afbc-529e2e5f69a7\",\r\n  \"account_id\": \"00000000-0000-0000-0000-000000000001\",\r\n  \"user_account_type\": \"TitanAdmin\",\r\n  \"application_access\": [\r\n    \"00000000-0000-0000-0000-000000000001\",\r\n    \"219d372b-be9a-4a1c-8aaa-b007991538b5\"\r\n  ]\r\n}\r\n```\r\n\r\nI'd like to use [ScopeValidationMiddleware](/IdentityModel/Thinktecture.IdentityModel/blob/master/source/Owin.ScopeValidation/ScopeValidationMiddleware.cs) to validate correct scopes are present, correct claims are present, and claim value(s) match the application's criteria.  For example, consider a web api request with the token above.  I need to:\r\n\r\n- assert the `application_access` claim contains a valid value for the resource\r\n- assert the  `user_account_type` claim value is authorized to access the resource\r\n\r\nAs it stands now, I think I would have to add `ScopeValidationMiddleware` twice to my Owin pipeline, one for each claim type.  I'd like to add one middleware to validate multiple claims.  I think a solution for this would be pretty straight-forward, based on the `ScopeValidationMiddleware` in IdentityModel.  Before doing that, I figured it wouldn't hurt to open a dialog as to whether others see value in enhancing `ScopeValidationMiddleware` as I've described.  If so, I'd be happy to submit a PR.\r\n\r\nThanks!"}}
{"actor":{"display_login":"engenb"}}