Adding user permission to the id-token

[stehranchi]

Hi
I’ve got a react application and a backend project which exposes some APIs.
I’ve assigned some roles to the users and some permissions to those roles. I have access to the permissions in my access token, so the backend project can authorize the user based on the permissions. But I need those permissions in the SPA too. For example the user should not be able to see the “edit post” button if he doesn’t have post:edit permission.
Of course I can parse the access token payload in the SPA and get the permissions from that, but this is not a good practice. Now I’ve two questions:

1. Is there a way to add permissions to the id token? (e.g. Via actions or any other way)
2. Is there a special reason that this is not the default behaviour of the system, because I think it is not a rare use-case.

[dan.woda]

Hi @stehranchi,

Welcome to the Auth0 Community!

There are quite a few posts in the forum about this:

How to add Roles and Permissions to the ID Token using Actions?

Problem statement Is it possible to retrieve the user’s Roles and/or Permissions and include them in the JWT Token? Solution Yes, it’s possible to retrieve the user’s Roles and/or Permissions and append them to either the ID Token or Access Token. To do so, you must use a Post-Login Action script. 1.1 Roles When adding the user’s Roles to the token, call the event.authorization.roles property and add it as a custom claim to the Token. Please see here on creating namespaced custom claims. Be…

How to add user permissions to ID token

Hey community. From our single-page application, we want to know the current user’s permission so we can control access to certain sections or buttons of our app. We’re using organizations. As you’re probably aware, permissions are assigned to roles. Users, in my understanding, can be assigned to roles within the context of organizations and can also be assigned to roles directly (outside the context of organizations). Because of this, we essentially need the union of permissions from (1) all t…

Adding Scopes/Permissions to ID Token

Hi, As a followup to this topic: Is there any official documentation or reference to how User Permissions can be appended to ID Tokens? The linked topic contains another link to a code snippet generously added by @ryantomaselli: And while this snippet looks like it may be a solution, it’s definitely not something I would consider official documentation. I would expect to see a working Rule code snippet, as well as instructions on how such a Rule should be added to the Auth Pipeline. Is…