Access token contains custom claims using Rules, but not Actions

[kelly.cliffe1]

Hi there,

I’ve been trying to follow the Auth0 docs to get a custom claim added to an access token.

The following code inside an action doesn’t work:

  const namespace = 'http://bruce.nexbe/';

  // https://auth0.com/docs/get-started/apis/scopes/sample-use-cases-scopes-and-claims#add-custom-claims-to-a-token
  // extract the bruce_role from app_metadata
  const bruce_role = event.user.app_metadata['bruce_role'] ?? '';
  api.idToken.setCustomClaim(`${namespace}/bruce_role`, bruce_role);

  const region = event.user.user_metadata['region'] ?? 'unknown region';
  api.idToken.setCustomClaim(`${namespace}/region`, region);  

  //console.log('adding region to access token');
  api.accessToken.setCustomClaim(`${namespace}/region`, region);

However, i’ve just tried using a Rule with the following code:

function addEmailToAccessToken(user, context, callback) {

  var namespace = 'http://bruce.nexbe/';
  const region = user.user_metadata.region || "unknown region";
  
  context.accessToken[namespace + 'region'] = region;
  return callback(null, user, context);
}

and the access token now contains the expected claim:

{
  "http://bruce.nexbe/region": "Canterbury",
  "iss": "....au.auth0.com/",
  "sub": "auth0|603edec1b5929e006b5dc2ee",
  "aud": [
    "https://bruce.api.dev",
    "https://.../userinfo"
  ],
  "iat": 1655281919,
  "exp": 1655368319,
  "azp": "z0Qd2eu7yAn4O6b5DaQz5kOocNJBtuVr",
  "scope": "openid profile offline_access"
}

Anybody got any idea why? TIA

[tyf]

Hi there @kelly.cliffe1 welcome to the community!

Have you had any luck sorting this out? Are you using a Post Login Action or something else? Your code looks OK to me so but I’d need to test this myself.

Let us know either way!

[kelly.cliffe1]

Hi there,

I haven’t really looked for other solutions - it’s working as described above so we’ve moved onto other issues. To be honest I’m not sure how we’d diagnose the action any further. Yes, it’s a Post Login action.

Cheers

[tyf]

Thanks for responding, and good to know it’s working in the context of a rule!

@kelly.cliffe1

To be honest I’m not sure how we’d diagnose the action any further.

I suppose I’d need to see the structure of the app_metadata, but that being said it seems like there could be a compatibility issue regarding legacy (authorization extension/rules) vs current (authorization core/actions). You can read more about Authorization Core vs. Authorization extension as well as the best practice to add roles to tokens using an Action:

Authorization Core vs. Authorization Extension

How to add Roles and Permissions to the ID Token using Actions?

Problem statement Is it possible to retrieve the user’s Roles and/or Permissions and include them in the JWT Token? Solution Yes, it’s possible to retrieve the user’s Roles and/or Permissions and append them to either the ID Token or Access Token. To do so, you must use a Post-Login Action script. 1.1 Roles When adding the user’s Roles to the token, call the event.authorization.roles property and add it as a custom claim to the Token. Please see here on creating namespaced custom claims. Be…

Hope this helps if you decide to go that route

[kelly.cliffe1]

Hi,

User_meta is pretty simple:

{
“region”: “…value…”
}

I read both linked articles - the Faq article is mainly relevant in that it shows setting of the access token value? Which i take it works theoretically - just not for us inside our action.

The Auth Core vs. Auth Extension - to be honest i’m not sure what the relevance is - is this an RBAC scenario?

I guess i’m still trying to understand why pretty much 1 line of code works in the rule, and not in the action - it feels like i’ve done something dumb, but i’m not sure what…

Thanks for replying by the way.