Add permissions to access token in actions (September 2023, rules are deprecated)

[dan.woda]

Hi @finom

@finom

1. Permissions is one of the core features of Auth0, why there is no easy way to get them?

You can add permissions in the access token by simply clicking the toggle ON for the “Add Permissions in the Access Token” setting. Please let me know if you need any clarification or if I can help you understand this feature.

@finom

2. Why secrets object is gone if Actions allow you to call Management API? It’s not allowed anymore? Should I hard-code the secrets by myself inside variables loosing some part of flexibility and probably security?

I’m not sure what you mean by “Why secrets object is gone”. The secrets object is a customizable store for sensitive data, and you can add whatever data you want in a secret. It is a perfect place to store a client ID and secret. You must add these properties (client_id, client_secret), they are not automatically configured in an Action.

See our documentation about how to write your first action.

@finom

If I still use Management API I’m going to get rate limit errors that need to be handled (I don’t know how to do that yet), is there any way to avoid using it at all?

See answer #1.

@finom

Why it’s becoming harder and harder to work with permissions? Are they going to disappear soon?

No. Can you give an example of how they have changed?

@finom

Maybe I don’t understand something (the purpose of roles and permissions, the way they need to be received) and I need to find an alternative approach? The only but horrible alternative I can see is to call Management API on every internal API request to receive an actual list of permissions, but obviously I’m going to hit the rate limit error much sooner. Please direct me if I do it wrong.

I would not suggest calling the managment API on every authentication. This is not a scalable pattern.

As for your first questions, they are addressed in our documentation (how secrets work, adding permissions to the AT). I would start by taking a look at our docs.

Write Your First Action

https://auth0.com/docs/get-started/apis/enable-role-based-access-control-for-apis

@finom

Unfortunately I can’t recommend to use Auth0 to my clients since one of the core and important features is not available anymore. I hope you can help me to find a solution that allows to identify user’s permissions without getting an additional source of problems such as API limits that I haven’t got while I was using Rules. Thank you.

Rules would have had the same issues with the management API rate limits. Management API calls from rules are still subject to rate limits.