Role-based filter for releasing scope values

[gueuselambix]

Hi
we have certain scopes which the authorization server should only release to an OAuth2-client if the user has the right role for it.

e.g. scope "courses_read" may only be issued when the user has the student-role.

You could of course implement this check at the resources (courses API in case of my example), but I believe it's the responsibility of the authorization server. Resources could then solely base their authorizations based on the presence the "courses_read" scope in the token.

[jricher]

This was considered a while ago in #351 but hasn't been implemented yet, to my knowledge. You'd need to hook into a few different places in the server to make it work. We'd be happy to take a pull request that made this a pluggable function.

[gueuselambix]

Hmm, ok, I am not that familiar with the code (yet), but perhaps I will look into that.
Thanks