title: Ocelot, Identity, IdentityServer4 and API Resource, how to grant access on a role basis
body: <p>I am trying to learn how a microservices approach with net core should be. So after a lot of tutorials this is what I have got so far:</p>
  <ol>
  <li><p>I have created two apis projects: Company and Package. Ports 5002 and 5010</p>
  </li>
  <li><p>I need a gateway, Ocelot is the one. I have this configuration:</p>
  </li>
  </ol>
  <pre><code>{
  
    &quot;Routes&quot;: [
      // Company Api
      {
        &quot;DownstreamPathTemplate&quot;: &quot;/api/company/{everything}&quot;,
        &quot;DownstreamScheme&quot;: &quot;http&quot;,
        &quot;DownstreamHostAndPorts&quot;: [
          {
            &quot;Host&quot;: &quot;localhost&quot;,
            &quot;Port&quot;: 5002
          }
        ],
        &quot;UpstreamPathTemplate&quot;: &quot;/api/company/{everything}&quot;,
        &quot;UpstreamHttpMethod&quot;: [
          &quot;GET&quot;
        ],
        &quot;AuthenticationOptions&quot;: {
          &quot;AuthenticationProviderKey&quot;: &quot;TestKey&quot;,
          &quot;AllowedScopes&quot;: []
        },
        &quot;AddHeadersToRequest&quot;: {
          &quot;CustomerId&quot;: &quot;Claims[sub] &gt; value&quot;
        }
      },
      // Anonymous Company Api
      {
        &quot;DownstreamPathTemplate&quot;: &quot;/api/company/getHomeSections&quot;,
        &quot;DownstreamScheme&quot;: &quot;http&quot;,
        &quot;DownstreamHostAndPorts&quot;: [
          {
            &quot;Host&quot;: &quot;localhost&quot;,
            &quot;Port&quot;: 5002
          }
        ],
        &quot;UpstreamPathTemplate&quot;: &quot;/api/anonymous/company/getHomeSections&quot;,
        &quot;UpstreamHttpMethod&quot;: [
          &quot;GET&quot;
        ]
      },
      // Package Api
      {
        &quot;DownstreamPathTemplate&quot;: &quot;/api/package/{everything}&quot;,
        &quot;DownstreamScheme&quot;: &quot;http&quot;,
        &quot;DownstreamHostAndPorts&quot;: [
          {
            &quot;Host&quot;: &quot;localhost&quot;,
            &quot;Port&quot;: 5010
          }
        ],
        &quot;UpstreamPathTemplate&quot;: &quot;/api/package/{everything}&quot;,
        &quot;UpstreamHttpMethod&quot;: [
          &quot;GET&quot;
        ],
        &quot;AuthenticationOptions&quot;: {
          &quot;AuthenticationProviderKey&quot;: &quot;TestKey&quot;,
          &quot;AllowedScopes&quot;: []
        }
      }
    ],
    &quot;GlobalConfiguration&quot;: {
      &quot;BaseUrl&quot;: &quot;http://localhost:5000&quot;
    },
    &quot;AllowedHosts&quot;: &quot;*&quot;
  }
  </code></pre>
  <ol start="3">
  <li>I have a identityServer4 configured with identity and mongoDB. Works like a charm.</li>
  </ol>
  <p>I have configured a client in angular 10. I can log in, I get the token and everything works as expected.</p>
  <p>Now my big question is, how do I grant access to users on a API / Role basis? So lets say Role A has access to company/read and Role B to company/read and company/write?</p>
  <p>How do actually achieve that?</p>
  <p>Thanks a lot.</p>