There will be three types of clients:
- Public mobile app client used by end-users that can access their profile, data, etc. (using password grant type). By "public" I mean that the app is intended from any user and available to any user from Google Store, etc.)
- Non-public administration client used only from me for administrative purposes that can access administrative services not allowed to be used by normal users (using client_credentials grant type).
- Non-public third-party client (using client_credentials grant type) that will use some services created specifically for them.
Should I just create three different roles, User, Admin and ThirdPartyX and secure services with 'oauth2.clientHasRole' rules? Or should I create different scopes and do not care about roles? Is there a general rule of thumb on where would I use roles or scopes in general?