title: OAuth authentication authorization
body: <p>i am totally confused about the usage of OAuth and i am not sure how to use oauth for my szenario. At the moment i use a "pure" JWT approach which looks like that:</p>
  
  <ol>
  <li>Client (JavaScript Application) send login and password to my Rest-Endpoint (Server (Java)).</li>
  <li>Server validate user informationen, read / generate some user roles and wrap it in a JWT Token (with a secret)</li>
  <li>Server send JWT Token back to client</li>
  <li>Client will perform additional Rest-Calls with Authorizationen Header</li>
  <li>Server validates Token with private secret and grand access based on roles/user</li>
  </ol>
  
  <p>Now i think about the usage of OAuth but i am confused how to use it to realize the szenario.</p>
  
  <ol>
  <li>I registered an application at "auth0".</li>
  <li>I use a JS library to redirect to the login process of auth0, login via auth0 account and consume the id_token and access_token</li>
  </ol>
  
  <p>=  i can send the id_token (JWT with RSA256) to my rest api, validate it with the public certificate and can extract some user information</p>
  
  <p>but:</p>
  
  <p>a) i have read that i should not use the id_token to access my api. Instead i should use the access_token (which is not in JWT format and will not give me any information about the user) and use the access_token to query for the user information? That whould be the case for every request?!</p>
  
  <p>b) i don't see the point where the user roles come into play. When i have some operations (rest endpoints) which are only allowed for "admins" or "customers". I don't see any possibility to define them. </p>
  
  <p>You see i am a little bit confused, i hope somebody can clarify all the things.
  Thanks a lot
  Chris</p>