[SOLVED] Cognito: User Pool Client OAuth Scope Limitation

Cognito: User Pool Client OAuth Scope Limitation

I have multiple Resource Server w/ multiple scopes each (see structure below). There is a hard limit of 50 scopes per app client. Docs. I want to have a configurable client that can have more than 50 scopes. Is there any way I can achieve that with Cognito User Pool?

Thank you in advance.

Resource Servers:
 Service1
  -read
  -write
 Service2
  -read
  -write
 ...
 Service50
  -read
  -write


App Client:
 Client1:
  -service1/read
  -service2/read
  ...
  -service50/read
 Client2: #Error (cannot have more than 50 scopes)
  -service1/read
  -service1/write
  -service2/read
  -service2/write
  ...
  -service50/read
  -service50/write

Solution

Feels like you may be over using scopes in your authorization - it is worth being aware that there are alternative designs that scale better:

Use scopes to represent high level business areas and set security boundaries
Use claims for dynamic authorization values that vary per user

API authorization is often a balancing act also. For example, you may need to include values not present in tokens in authorization decisions. It it helps, my API authorization behaviour blog post has some notes on OAuth authorization with good manageability.