I mainly just want a lead in a direction with this. I'm not asking about specific frameworks to use, even if I mention them, just how it's supposed to work.
I am trying to get an understand of how these technologies can be used together (asp.net core, angular, openid-connect).
Right now, I have an Authentication Server. This will use both Asp.Net Identity, as well as IdentityServer 4. I understand that OAuth is not meant to be an authentication layer, so Asp.Net Identity will fill that gap. At this level, I have no permissions or anything, only the users profile (emails, etc).
The next layer is my API (there will be many, that should all use the same usernames and emails, such as what's on stackoverflow/stackexchange). At this level, I would like to store each users individual permissions for the app. This is one of the more confusing parts for me. I am simply given a token from the Authentication Server, how can I save off what user it's actually supposed to be for? I can't change the token that the authentication server gives me (that would invalidate the token), and how could i save off which user its for, since that information could change on the authentication server side?
Finally, I have an angular app, that would use implicit flow to connect to the api -> that would redirect to my authentication layer.
Is my idea on how this is meant to work correct? Am I wrong at how this is all supposed to tie together? Should we not even host our own OAuth based servers?
Sorry for the ignorance, but I just can't grasp it (I'm used to a login-flow, where you just type in your credentials and save everything on the same layer, which I know you can do but isn't recommend** in oauth servers.)
I've looked at these open source examples: https://github.com/elanderson/Angular-Core-IdentityServer https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow
but the first one doesn't compile, and I can't figure for the life of me to even get the second one running.