Adding a simple Admin identifier to access token

[KINGKENNA]

Hello, I am new to Auth0 and am getting a little confused between all the terms and concepts.
I want to add an admin identifier to certain user’s access tokens. My Spring application will extract this information from the access token and use its presence to allow access to certain resources.

Should this identifier be a role, permission, scope or a claim?
I have seen Role-based access control mentioned in a few places is this relevant to what I am trying to do?

Is below a valid approach or am I missing something:

1. Add my created ‘ADMIN_ROLE’ to certain users using UI. This will contain no permissions ( it says ’ no apis found’ when I tried)
2. Create a custom action as part of the login flow which will add all role names to a user’s action token when they log in.
3. extract this in my backend application

Any help is appreciated, I feel like I am drowning in information.

[tyf]

Hey there @KINGKENNA welcome to the community!

You’re definitely on the right track looking into using RBAC - If enabled by your API you can have permissions automatically added to a user’s access token as a custom claim. Typically, the permissions in an access token are enough to infer the role, but you can also add a users roles to an access token in a custom claim using a Post Login Action. An example of this might be:

exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'https://myapp.example.com/';
  const assignedRoles = (event.authorization || {}).roles;

  if (assignedRoles && assignedRoles.length > 0) {
    api.accessToken.setCustomClaim(`${namespace}roles`, assignedRoles);
  }
};

Your backend will have access to these claims (roles, permissions) and can make authorization decisions accordingly.

[mraible]

@KINGKENNA Hopefully @tyf’s answer helped. If you’re using Spring Boot, our RBAC in Spring Boot lab might help. It shows how to use the Okta Spring Boot starter to easily map your roles to Spring Security authorities. You just need one property to make it work with the above example:

okta.oauth2.groupsClaim=https://myapp.example.com/roles

[tyf]

Woo! Thanks @mraible

[KINGKENNA]

Thanks for reply’s, I added a post login action as suggested but it does not seem to be triggered when a user logs in. My access token/id token do not contain any roles.

exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'test123';
  if (event.authorization) {
    console.log('test!!')
    console.log(event.authorization.roles)
    api.idToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
    api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
  }
}

It is deployed and added to my login flow. I get no logs showing up when using the Real-time Webtask Logs Extension. The logs display when I test run my action but not in the actual login flow.