<commit_before>.. _refResources:
Defining Resources
==================
The ultimate job of an OpenID Connect/OAuth token service is to control access to resources.

The two fundamental resource types in IdentityServer are:

* **identity resources:** represent claims about a user like user ID, display name, email address etc…
* **API resources:** represent functionality a client wants to access. Typically, they are HTTP-based endpoints (aka APIs), but could be also message queuing endpoints or similar.

.. note:: You can define resources using a C# object model - or load them from a data store. An implementation of ``IResourceStore`` deals with these low-level details. For this document we are using the in-memory implementation.

Identity Resources
------------------
An identity resource is a named group of claims that can be requested using the *scope* parameter.

The OpenID Connect specification `suggests <https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims>`_ a couple of standard 
scope name to claim type mappings that might be useful to you for inspiration, but you can freely design them yourself.

One of them is actually mandatory, the *openid* scope, which tells the provider to return the *sub* (subject id) claim in the identity token.

This is how you could define the openid scope in code::

    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
        return new List<IdentityResource>
        {
            new IdentityResource(
                name: "openid",
                claimTypes: new[] { "sub" },
                displayName: "Your user identifier")
        };
    }

But since this is one of the standard scopes from the spec you can shorten that to::

    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
        return new List<IdentityResource>
        {
            new IdentityResources.OpenId()
        };
    }

.. note:: see the reference section for more information on ``IdentityResource``.

The following example shows a custom identity resource called *profile* that represents the display name, email address and website claim::

    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
        return new List<IdentityResource>
        {
            new IdentityResource(
                name: "profile",
                claimTypes: new[] { "name", "email", "website" },
                displayName: "Your profile data")
        };
    }

Once the resource is defined, you can give access to it to a client via the ``AllowedScopes`` option (other properties omitted)::

    var client = new Client
    {
        ClientId = "client",
        
        AllowedScopes = { "openid", "profile" }
    };


The client can then request the resource using the scope parameter (other parameters omitted)::

    https://demo.identityserver.io/connect/authorize?client_id=client&scope=openid profile

IdentityServer will then use the scope names to create a list of requested claim types, <commit_msg>Updating resources.rst documentation file (#4811)<commit_after>.. _refResources:
Defining Resources
==================
The ultimate job of an OpenID Connect/OAuth token service is to control access to resources.

The two fundamental resource types in IdentityServer are:

* **identity resources:** represent claims about a user like user ID, display name, email address etc…
* **API resources:** represent functionality a client wants to access. Typically, they are HTTP-based endpoints (aka APIs), but could be also message queuing endpoints or similar.

.. note:: You can define resources using a C# object model - or load them from a data store. An implementation of ``IResourceStore`` deals with these low-level details. For this document we are using the in-memory implementation.

Identity Resources
------------------
An identity resource is a named group of claims that can be requested using the *scope* parameter.

The OpenID Connect specification `suggests <https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims>`_ a couple of standard 
scope name to claim type mappings that might be useful to you for inspiration, but you can freely design them yourself.

One of them is actually mandatory, the *openid* scope, which tells the provider to return the *sub* (subject id) claim in the identity token.

This is how you could define the openid scope in code::

    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
        return new List<IdentityResource>
        {
            new IdentityResource(
                name: "openid",
                userClaims: new[] { "sub" },
                displayName: "Your user identifier")
        };
    }

But since this is one of the standard scopes from the spec you can shorten that to::

    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
        return new List<IdentityResource>
        {
            new IdentityResources.OpenId()
        };
    }

.. note:: see the reference section for more information on ``IdentityResource``.

The following example shows a custom identity resource called *profile* that represents the display name, email address and website claim::

    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
        return new List<IdentityResource>
        {
            new IdentityResource(
                name: "profile",
                userClaims: new[] { "name", "email", "website" },
                displayName: "Your profile data")
        };
    }

Once the resource is defined, you can give access to it to a client via the ``AllowedScopes`` option (other properties omitted)::

    var client = new Client
    {
        ClientId = "client",
        
        AllowedScopes = { "openid", "profile" }
    };


The client can then request the resource using the scope parameter (other parameters omitted)::

    https://demo.identityserver.io/connect/authorize?client_id=client&scope=openid profile

IdentityServer will then use the scope names to create a list of requested claim types, 
{'fraction_non_alphanumeric': 0.08155212101282473, 'fraction_numerical': 0.0013153567905294311, 'mean_word_length': 3.160738714090287, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 17, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5752114', 'n_tokens_mistral': 1470, 'n_tokens_neox': 1416, 'n_words': 688}