tldr: In building a platform where users can create private groups, and invite other people to those private groups, how is it be to secure those groups?
I'm building a platform around private groups and communities. I'm not really sure on what is the most suitable pattern/mechanism to secure groups so only those invited can read/write.
Technology is Okta and Spring Security.
Should I be creating groups and using the role claim in a oauth token, so when I user creates a new group I'd need to create that group on the auth server and add that group to each user who is invited. This would work I believe but with how Spring Security works would require users to log out and back in, in order to gain the new group.
Is scopes instead another alternative? or would I make use of claims and each new group created would need the user to "authenticate" with the group?
Do I just limit/control access based on what groups the user profile has assigned to it? Seems simple but also doesn't seem the most secure.
I'm sure there is a pretty standard way to handle this I'm just not sure what approach to take.