title: Identity Server - Identity/Resource scope - How can client get resource claims about the user
body: <p>I have read Dominik's blog post on authentication vs permission modeling using Identity Server (<a href="https://leastprivilege.com/2016/12/16/identity-vs-permissions/" rel="noreferrer">https://leastprivilege.com/2016/12/16/identity-vs-permissions/</a>). Since I am mostly using role based authorization, I am fine using IdentityServer as authentication/authorization endpoint for different client and apis.</p>
  
  <p>My question is how to model Identity and Resource scopes properly? Can client know which roles are allowed for the user on specific resource? If yes, can client know only the user roles for requested resources scopes (and not all roles for all scopes).
  As far as I understand the concept, if I request claims about the user via <em>UserInfo</em> endpoint, I am receiving claims which are filtered by claimTypes listed inside requested identity scopes. That means that if client requests <em>roles</em> scope (identity scope with <em>role</em> claimtype), <em>UserInfo</em> endpoint will respond with all role claims including other applications.</p>
  
  <p>Let's take simple MVC example, where the MVC client communicates with API via REST.
  MVC client (client) uses Cookie/OIDC Auth middleware and requests: <code>ResponseType = "id_token token", Scope = "openid profile api"</code>.
  The API (resource) uses IdentityServerBearerToken Auth middleware and demands: <code>RequiredScopes = "api"</code>.
  The client has UI elements which should be visible based on <em>api</em> role. How can the roles be accessed from client, since the <em>UserInfo</em> endpoint will only return identity scope based claims?
  Should client ask the API (resource), which actions are possible? And based on the response show/hide UI elements?</p>
  
  <p>Thank you for any help.</p>