Restrict access some Endpoints to GlueBackendAPI for certain users using OAuth

daniar.asanov

We use GlueBackendAPI to give access for 3rd Party services to our data. They all autheticate using OAuth. OAuth has so calles scopes to restrict access to certain endpoints. This is also said in the Documentation but no examples how to do that. There is a manual of how to create a scope, but nothing about how to relate a scope to ACL or to a client/user directly.

All a user can do is enter a scope when requesting a token. But the user can then request a token to any scope or even just without any scope and have an access to all endpoints. Is there any solution how to setup this restriction?

profuel

Just to clarify that we both read the same documentation - https://docs.spryker.com/docs/dg/dev/glue-api/202410.0/use-glue-api-authorization-scopes.html - here we explain how to use scopes.

If our implementation doesn't match your needs, you may always implement your own, following this guide: https://docs.spryker.com/docs/dg/dev/glue-api/202410.0/create-glue-api-authorization-strategies.html

daniar.asanov

I read the following documentation -

https://docs.spryker.com/docs/dg/dev/glue-api/202410.0/use-glue-api-authorization-scopes.html

But any user that can generate a token with his/her credentials and knows the name of a scope, can generate a token to the scope and access it. How can I limit a user to a certain scope and not being able to access any othe Endpoint?