Difference between role and client scope

[Patrick Brunmayr]

What exactly is the difference between a role and a client scope? In my understanding a client scope is some kind of permission which can be requested in the authentication process using the IODC scope parameter. A role is a set of permissions. 

So how would i do the following in KC ?

Given the role "editor" it has three permissions

• edit:user
• edit:account
• edit:billing

I would create three client scopes for that. After that i would map the three scopes to role "editor". But unfortunately i would assume only one is a kind of "editor" if all of the

three scopes have been requested and not less. I did not find any way to do this.

Otherwise i would have to create a role for each permission and do the mapping!

So the permission 

• edit:user becomes role edit_user
• edit:account becomes role edit_account

and so on.

[Patrick Brunmayr]

the reason why I ask the question is because it determines the way i will do my security checks. It's a big difference if i do 

user.hasRole("editor")

or

user.checkScope("edit:user")

user.hasRole("editor")