This approach uses claims-based authentication for the API, with roles as a convenient way to manage claims.
Each user or authenticating entity can be assigned one or more roles, and each role maps to a predefined set of claims that represent specific permissions (e.g., can_view_reports
, can_edit_users
, etc.).
Two advanced features will be supported: