Dealing with permissions

Good introduction.
Sometimes, a microservice might require the user to have certain roles or permissions to access particular api's. It would be good to touch upon this common requirement and how it might be handled too.

For example, the identity service authenticates a user and responds with a token to the client. Should this token include claims for roles and permissions? Does identity server 4 allow you to customise the token to include additional claims such as your own permission claims in this scenario? The token is then provided by the client as a Bearer token to a downstream microservice which uses JWT auth Bearer middleware to validate it and restore the user claims principle - in this model the claims would contain Roles and permissions and so [Authorize] attributes can be used on particular api's that assert the user must have particular claims. This is one model, but it means the identity service must be able to enrich a token with all roles and permissions needed for every microservice that could possibly be used by the client in advance. Are there alternative models that would be recommended?

---
#### Document Details

⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*

* ID: d926868f-5446-63c6-75c0-ba879879f4b5
* Version Independent ID: ff9b78ce-a923-e763-08d5-c31cbb6a1f0e
* Content: [Securing .NET Microservices and Web Applications](https://docs.microsoft.com/en-us/dotnet/architecture/microservices/secure-net-microservices-web-applications/)
* Content Source: [docs/architecture/microservices/secure-net-microservices-web-applications/index.md](https://github.com/dotnet/docs/blob/main/docs/architecture/microservices/secure-net-microservices-web-applications/index.md)
* Product: **dotnet-architecture**
* Technology: **microservices**
* GitHub Login: @mjrousos
* Microsoft Alias: **nanil**