allow authentication per client per role

I don't believe that this will come for D7 code but this would be easy possible with custom code when ✨ Add hook to control account client access Active will be accepted.

This should work, but by the time you have 50 clients, the permissions form would be a 100MB page load, so there are some potential practical obstacles ;-)

I have a similiar issue for my use case and what I've done is link a taxonomy vocabulary to my users. The taxonomy terms match sites that uses should be allowed to access. To grant access, I tag a user. To remove access, I untag them. A different vocabulary controls roles.

To achieve that, I've written a small custom module that maps the vocabularies to custom claims in `hook_oauth2_server_user_claims_alter()`. The client side of things can then check the claims and grant access and permissions based on that.

I won't suggest to organize clients with roles. In our own project we will organize clients with the upcoming module grant → . And on our client projects I try to reduce roles.