title: OAuth2 and role-based access control
body: <p>I have a Rails app acting as an OAuth 2.0 provider (using the <a href="https://github.com/freerange/oauth2-provider" rel="noreferrer">oauth2-provider</a> gem). It stores all the information related to users (accounts, personal information, and roles). There are 2 client apps that both authenticate through this app. The client apps can use the <code>client_credentials</code> grant type to find users by email and do other things that don't require an authorization code. Users can also log in to the client apps using the password grant type.</p>
  
  <p>Now the issue we're facing is that the users' roles are defined globally on the resource host.  So if a user is given an <code>admin</code> role on the resource host, that user is <code>admin</code> on both clients. My question is: what should we do to have more fine-grained access control? I.e. a user can be an <code>editor</code> for <code>app1</code> but not for <code>app2</code>.</p>
  
  <p>I guess the easy way to do this would be to change the role names like so: <code>app1-admin</code>, <code>app2-admin</code>, <code>app1-editor</code>, <code>app2-editor</code>, etc. The bigger question is: are we implementing this whole system correctly; that is, should we be storing so much info on the resource host, or should we denormalize the data onto the client apps?</p>
  
  <p>A denormalized architecture would look like this: all user data on the resource host, localized user data on each client host. So <code>user@example.com</code> would have his personal info on the resource host and have his <code>editor</code> role stored on client <code>app1</code>. If he never uses it, <code>app2</code> could be completely oblivious of his existence.</p>
  
  <p>The drawback to the denormalized model is that there would be a lot of duplication of data (account ids, roles) and code (<code>User</code> and <code>Role</code> models on each client, separate management interfaces, etc.).</p>
  
  <p>Are there any drawbacks to keeping the data separate? The client apps are both highly trusted--we made them both--but we are likely to add additional client apps, which are not under our control, in the future.</p>