# Add Auth Core Role on Automatic User Migration

**URL:** <https://community.auth0.com/t/add-auth-core-role-on-automatic-user-migration/26848>\
**Category:** Get Help\
**Tags:** user-profile, migration, roles\
**Created:** [June 20, 2019, 3:13am UTC](https://community.auth0.com/t/add-auth-core-role-on-automatic-user-migration/26848 "2019-06-20T03:13:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![producdevmatt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/producdevmatt/32/12776_2.png) [@producdevmatt](https://community.auth0.com/u/producdevmatt)\
**Post date:** [June 20, 2019, 3:13am UTC](https://community.auth0.com/t/add-auth-core-role-on-automatic-user-migration/26848/1 "2019-06-20T03:13:06Z")

</div>

I recently setup a new Auth0 connection database, configured as a “custom database” with automatic migration turned on. This works great – upon initial sign in, it reaches out to my legacy SQL user store and migrates it over with the proper id, password and metadata.

I’m at a loss as to how I can, at the point of migration, assign an Auth Core Role (for RBAC) to the user based on their profile from SQL. I have turned on “Add Permissions in the Access Token” - so the goal is to have the permissions for the assigned roles be populated in the initial access token.

What I’ve tried:

- Added a `roles` array under both the `app_metadata` and `user_metadata` objects, knowing there was no reason this would work 🙂

- Creating a rule to read the user’s role out of `app_metadata` and assign it to the real role system via the Auth0 Management Client. This does add the role, however the permissions do not appear until the subsequent login.

- Creating a hook to do the same as above, but it doesn’t solve the problem. Not only do the hooks not seem to trigger on the migration event, but the lifecycles don’t match up - either the user doesn’t exist yet (pre-creation) or it happens async outside of the login process.

Any ideas? Anything simple I’m missing that would allow me to pull this off?

Thanks!

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [June 20, 2019, 7:44pm UTC](https://community.auth0.com/t/add-auth-core-role-on-automatic-user-migration/26848/2 "2019-06-20T19:44:42Z")

</div>

Hi @producdevmatt,

This should be possible. Can you DM me your tenant name so I can take a look at the rule you are using?

Thanks  
Dan

---

<div class="post-metadata">

**Author:** ![producdevmatt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/producdevmatt/32/12776_2.png) [@producdevmatt](https://community.auth0.com/u/producdevmatt)\
**Post date:** [June 21, 2019, 8:39pm UTC](https://community.auth0.com/t/add-auth-core-role-on-automatic-user-migration/26848/3 "2019-06-21T20:39:35Z")

</div>

Thanks for the quick reply, Dan

We ended up taking a different approach in the short term so I deleted my rule 😕 But, we need to make this happen eventually. What I was using is a simplified version of the same code as [this other post](http://community.auth0.com/t/add-role-to-a-user-on-sign-up-using-roles-not-app-metadata/26321/4):

```
function (user, context, callback) {

  // Roles should only be set to verified users.
  if (!user.email || !user.email_verified) {
return callback(null, user, context);
  }
  
  // short-circuit if the user signed up already or is using a refresh token
  if (context.stats.loginsCount > 1 || context.protocol === 'oauth2-refresh-token') {
return callback(null, user, context);
  }
  
  const getRolesForUser = (user) => {
const roles = [
  'rol_XXXXXXXXXXXX' // default
];
try {
  const emailDomain = user.email.split('@')[1].toLowerCase();
  switch (emailDomain) {
    case 'somedomain.com':
      roles.push('rol_XXXXXXXXXXXX');
      break;
    // More custom rules here
  }
  return roles;
} catch (e) {
  console.error(e);
  return [];
}
  };
  
  const roles = getRolesForUser(user);
  
  // Role management was introduced in 2.17.0.
  // 2.17.1 intermittently returned package not found error.
  // Unspecified version didn't support roles, so must be earlier than 2.17.0
  var ManagementClient = require('auth0@2.17.0').ManagementClient;
  var management = new ManagementClient({
token: auth0.accessToken,
domain: auth0.domain
  });
  
  // Update the user's roles
  management.assignRolestoUser({ id : user.user_id }, { roles: roles }, (err) => {
if (!err) {
  console.log('Roles [' + roles.join(', ') + '] assigned to user [' + user.email + ']');
} else {
  console.error(err);
}
return callback(err, user, context);
  });
  
} 

```

It does work - the user migration from SQL happens, it properly adds the role, but the “permissions” array does not get populated on the JWT token when “Add Permissions in the Access Token” is turned on.

On the subsquent login, the permissions array is filled as expected.

Any ideas there?

And as sort of a follow-up, would there be any good way to pull this off with role _names_ instead of ids? I suppose you could make an initial call to get all the roles.

Thanks for any help / thoughts!

---

<div class="post-metadata">

**Author:** ![sgo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sgo/32/13789_2.png) [@sgo](https://community.auth0.com/u/sgo)\
**Post date:** [February 4, 2021, 10:34am UTC](https://community.auth0.com/t/add-auth-core-role-on-automatic-user-migration/26848/4 "2021-02-04T10:34:47Z")

</div>

The behaviour appears to have changed for this scenario since this was first opened, I discovered this working on a similar support ticket.

You should now be able to receive a token with the permissions array populated for the relevant role assigned in the rule, on the first login for a user on a Custom Database. This was tested with version `auth0@2.31.0` of the Management Client, using the assignRolestoUser method like in the shared rule above.  
[https://auth0.github.io/node-auth0/module-management.ManagementClient.html#assignRolestoUser](https://auth0.github.io/node-auth0/module-management.ManagementClient.html#assignRolestoUser)

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 4, 2021, 11:46am UTC](https://community.auth0.com/t/add-auth-core-role-on-automatic-user-migration/26848/5 "2021-02-04T11:46:38Z")

</div>

Thanks for sharing that Steve!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 19, 2021, 11:47am UTC](https://community.auth0.com/t/add-auth-core-role-on-automatic-user-migration/26848/6 "2021-02-19T11:47:00Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.