title: Should I send identity token to my api resources?
body: <p>Ciao,</p>
  
  <p>I'm working with IdentityServer4 with the goal of protecting an resource api and exposing an identity server inside my organization.</p>
  
  <p>So actually I have this elements:</p>
  
  <ul>
  <li>Authorization Server</li>
  <li>API Resources</li>
  <li>Client (SPA application)</li>
  </ul>
  
  <p>I want to protect my API using scope and single actions accessed by user's roles. So for example I have this apis: </p>
  
  <pre><code>- API 1 (Scope API 1)
      - Action1.1 &lt;-- Only admin
      - Action1.2 &lt;-- Only manager
      - Action1.3 &lt;-- Only manager
  
  - API 2 (Scope API 2)
      - Action2.1 &lt;-- Admin and manager
      - Action2.2 &lt;-- Only users
      - Action2.3 &lt;-- Only users
  </code></pre>
  
  <p>I know that OAuth2 protocol is for authorization (with its access_token) and OpenID Connect enrich OAuth2 protocol supporting authentication (with its identity_token).</p>
  
  <p>I would know what is the best practices for achive my goal. I've found two options:</p>
  
  <ol>
  <li>Send to API Resource identity_token and authorization_token (so that I can view user's role by identity_token and is can access to the scope).</li>
  <li>Adding role to access_token.</li>
  </ol>
  
  <p>What is the best practice? Any advice is welcome</p>
  
  <p>Thanks</p>