title: Configuring User Authorization in Client Applications
body: <p><strong>Background Explanation</strong></p>
  
  <p>When it comes to Identity Server 4, I come to a road block when i think about the design of user management in the client applications.</p>
  
  <p>At this point, I have Identity Server setup using ASP Identity User Accounts as its user store.</p>
  
  <p>I've built the UI for adding users to the Identity Server User Store. </p>
  
  <p>I've tested setting up a client which is an MVC application, and I'm at the point where i can successfully authenticate with Identity Server and receive the openid identity token in my client application.</p>
  
  <p>Identity Server is providing my client application with authentication.</p>
  
  <p>Now, i need to concentrate on authorization within my app. This is where i get stuck, I need to create users local to the application, where user privileges within the application are stored. </p>
  
  <p>I will need to link / associate the user in Identity Server to the user in the client application.</p>
  
  <p>One way to do this would be to store the sub in the identity token as a user claim in the client application database (Asp Identity). This way, when a user authenticates i can locate them in the local db, based on the sub in the token. </p>
  
  <p>The sub would have to be the user's unique id in the identity server user store. This way, if the user's email is changed, we can still link the two user accounts.</p>
  
  <p>The user accounts in the client application wouldn't require passwords or email addresses, it would be purely claims and roles that are used for authorization across the application, as well as any other application specific information.</p>
  
  <p><strong>Question</strong></p>
  
  <p>Communication between Identity Server and the client application must need to exist when creating users in the client application?</p>
  
  <ul>
  <li>We need to associate the two accounts?</li>
  <li>We need to ensure that the client user account being created also has an Identity Server user account to be successfully authenticated?</li>
  </ul>
  
  <p>When in the process should these tasks be complete? Im looking for some guidance in the flow of the communication between the two applications?</p>
  
  <p><strong>EDIT</strong> </p>
  
  <p>Is it feasible that there are no User Accounts in the client application at all?</p>
  
  <p>By this i mean that all user claims for a user are stored in the User store of Identity Server.</p>
  
  <p>When a client authenticates with the IDP it requests only the user claims that are specific to the client application.</p>
  
  <p>Example user claims in the User Store :-</p>
  
  <ol>
  <li>"clientA_role" : "administrator" </li>
  <li>"clientB_role" : "user"</li>
  </ol>
  
  <p>When <strong>Client Application A</strong> authenticates, it requests only the scope <strong>clientA_role</strong></p>
  
  <p>This feels bad! </p>
  
  <p>Any suggestions?</p>