Adding Scopes/Permissions to ID Token

[subtlestag]

Hi,

As a followup to this topic:

How to add user permissions to id token?

Hi, I am using RBAC core. I have enabled RBAC in my api settings. I see that there is an “Add Permissions in the Access Token” option. If you enable RBAC for APIs and set the Token Dialect appropriately, you will receive user permissions in your Access Tokens. How can I add the permission to the id_token? Is it possible ? http://community.auth0.com/t/role-based-access-control-roles-permissions-product-roadmap-launched/22878/12

Is there any official documentation or reference to how User Permissions can be appended to ID Tokens?
The linked topic contains another link to a code snippet generously added by @ryantomaselli:

Accessing the permissions array in the access token

Alright thanks @mathiasconradt I’m finally cooking with butter over here… I’m pasting my rule that augments the idToken with user permissions here for others: function (user, context, callback) { var map = require('array-map'); var ManagementClient = require('auth0@2.17.0').ManagementClient; var management = new ManagementClient({ token: auth0.accessToken, domain: auth0.domain }); var params = { id: user.user_id, page: 0, per_page: 50, include_totals: true }; management.ge…

And while this snippet looks like it may be a solution, it’s definitely not something I would consider official documentation.

I would expect to see a working Rule code snippet, as well as instructions on how such a Rule should be added to the Auth Pipeline.

Is there a reason Scopes aren’t appended to an ID Token by default? I’d like to be able to check the scope property just as I check M2M JWT scopes.

[rueben.tiow]

Hi @subtlestag,

Thanks for reaching out to the Auth0 Community!

@subtlestag

Is there any official documentation or reference to how User Permissions can be appended to ID Tokens?

Unfortunately, there is no officially written documentation on appending user permissions to ID Tokens. Instead, the related community post that you found is the best source for solutions that are not available out of the box.

When using Rules, they are always triggered post-authentication in the auth pipeline. Therefore, the user’s permissions are retrieved on login and then appended to the ID Token in the example.

@subtlestag

Is there a reason Scopes aren’t appended to an ID Token by default? I’d like to be able to check the scope property just as I check M2M JWT scopes.

Scopes are not part of the required ID token claims as defined in the OpenID ID Token specification but can be included optionally as custom claims.

Generally, scopes are appended to the Access Tokens when you specify the scope parameter in the /authorize request. For example scope=openid profile email read:reports. Therefore, you will need to append the scopes as custom claims to the ID Token if you wish you include them there.

Hoped this answers your questions.

Please let me know if you have any further concerns or questions.

Thanks.