Adding user roles to access token

[chris.tice]

Following this guide (Login Flow), I can successfully add the list of users roles to the access token, but it only works when the role has been assigned as part of organization.

If I assign the role to the user directly (from the user details page), it does not show up in the list of roles.

Is it possible to include user roles that have been added directly?

[tyf]

Hey there @chris.tice welcome to the community!

This is a bit of a tricky use case - The following topic is more geared towards permissions, the same goes for roles as well:

How to add user permissions to ID token

Hey community. From our single-page application, we want to know the current user’s permission so we can control access to certain sections or buttons of our app. We’re using organizations. As you’re probably aware, permissions are assigned to roles. Users, in my understanding, can be assigned to roles within the context of organizations and can also be assigned to roles directly (outside the context of organizations). Because of this, we essentially need the union of permissions from (1) all t…

Hope this helps!

[chris.tice]

What I ended up doing is using a custom Action with the Management API to query for a users direct roles, and adding the list of roles to the token as a custom claim.

Login Flow

exports.onExecutePostLogin = async (event, api) => {
  const ManagementClient = require('auth0').ManagementClient;
  const management = new ManagementClient({
      domain: event.secrets.domain,
      clientId: event.secrets.clientId,
      clientSecret: event.secrets.clientSecret,
  });

  const namespace = 'my-namespace';
  try {
    // Get the list of global roles for a user
    const roles = await management.getUserRoles({
      id: event.user.user_id,
    });

    const roleNames = roles.map((role) => role.name);

    api.idToken.setCustomClaim(`${namespace}/globalRoles`, roleNames);
    api.accessToken.setCustomClaim(`${namespace}/globalRoles`, roleNames);
  } catch (e) {
    console.log(e);
  }
};

[tyf]

Hey @chris.tice thanks for sharing here

Just be aware that calls to the Management API are rate limited as stated in the doc on Actions limitations.

You may also want to look into caching Management API tokens:

Caching Management API Access Tokens in Login Action

Problem statement: How do I cache a Management API access token(s) using the Node Management Client and Actions caching functionality? Auth0 recently announced the ability to cache tokens within our extensibility solution, Actions. This has been a much requested feature that we are excited to have finally released. As many users utilize the Node Management Client to interact with the Management API by way of Actions, the question of how to incorporate the new caching functionality has arisen. S…

Cheers!