rest - Multiple authentication levels in a RESTful API -

scenario

we building new restful api our web application. api serve our mobile applications, our web application , authorised customers.

we using apigility build api , making use of oauth2 implementation provides.

currently, our web application relies on users table, permissions assigned each user. these users log-in using web form, , session stored , appropriate permissions checked upon access.

we want able authenticate api access (such our web app, , authorised customers), no unauthorised access api can happen. however, want authorize permissions @ user level, therefore sort of user authentication must happen well.

any authorised access api may use different user, relying on single user per client not work, since permissions on per user basis. not want user able use api without prior authentication, wanted avoid adding every user client oauth2.

for example:

the web app authenticated api 2 users using it:

usera has user management permissions

userb not have user management permissions

therefore, usera can post /users , receive 200 ok while userb should receive 403 forbidden.

what have tried

we have created example application, , have set authentication using oauth2 high-level clients , can make calls expected. have not been able create authorization model our users based on this.

we though adding custom http header user token provided after authenticated call /user/login. not sure if correct method.

the question

how can both authenticate high-level clients (such our web app, or authorised customers) authorize access based on user using system?

you have few options available you:

token-level permissions

you can provide different tokens each user account, , tie permissions token. runs risk of wrong tokens being mixed wrong users. however, has advantage of not having maintain user<->token relationship, permission decided @ token level. how decide token generate can tricky.

user-level permissions

you can tie user account token , user can given read/write permissions. reduces risk of user having wrong token they're linked. method, can use same method of token generation user accounts token ignorant of permission, allow them "access" api (thus preventing unauthorised access).

i've deliberately avoided mentioning specific types of authentication tokens, these 2 concepts can apply of popular choices on web (token-based, oauth based).