Assign Roles to users using Rules

Help
1

Hi All,

At the moment, we are using “Attach Role” Management API to assign a role to users. Is there a way to do this via Rules? Currently when using rules… it is creating roles in app_metadata or user_metadata.

Thanks,
Bharathi

1 Like
3

Hi @bharathi.a16

Here’s a post showing how to call the management API from rules - How do I add a default role to a new user on first login?

Could you share your need on why you want to attach roles in rules ? I’d like to understand if there’s any missing feature in our core that makes you rely on rules to support your use case.

Thanks,
Marcos

1 Like
4

The linked thread shows a proper way to assign a role using the request package. Just wanted to point out that in Rules there is also the Node-SDK and thus ManagementClient object available (though requires to use the higher version than the default) which already has a wrapper method for assigning roles, so that could be used alternatively:

function (user, context, callback) {

  var count = context.stats && context.stats.loginsCount ? context.stats.loginsCount : 0;
  if (count > 1) {
    return callback(null, user, context);
  }

  var ManagementClient = require('auth0@2.17.0').ManagementClient;
  var management = new ManagementClient({
    token: auth0.accessToken,
    domain: auth0.domain
  });

  management.assignRolestoUser(
    { id : user.user_id}, 
    { "roles" :["rol_Y4j6ngQoZpQ3fGmu"]},  // sample role ID of "Standard API Enduser"
    function (err) {
      if (err) {
        console.log('Error assigning role: ' + err);
      }    
      callback(null, user, context);
  });
}

In regards to use case: I came across similar request from a customer (for whom I had provided the above script) before where a newly registered user should automatically have a specific role, such as Standard API Enduser assigned in order to get proper role and especially permissions based on this role assigned in order to call a protected API (=> permitted scopes in access token). If using RBAC Core and permissions assigned to roles, these would otherwise not be returned in the user’s access token at first login.

9 Likes
5

Hi @mathiasconradt

a newly registered user should automatically have a specific role, such as Standard API Enduser assigned in order to get proper role and especially permissions based on this role assigned in order to call a protected API

let me dig into this a little bit more. Would that role be assigned to every user or that depends on some condition ? If every user is getting that role, couldn’t you model the API to grant access by just having a valid access token ?

6

Would that role be assigned to every user or that depends on some condition ?

Every user that signs up using the web interface (Standard API Enduser), as opposed to a machine as in M2M, so it should make a difference whether a real end-user or a machine makes the call. Both have different roles and permissions, so an access token retrieved via Client Credentials Grant (M2M) should therefore hold different permissions.

7

Hi @Marcos_Castany,

We are using API to create users into Auht0 using Management Token and another API call to attach role. I just am trying to see if I can avoid extra API call to assign role.

Also, if I may ask… when we retrieve user information it does not show any roles attached to the user in the response. Is there a way we can get to see that info? apart from having it in user_metadata or app_metadata in the user profile.

Thanks,
Bharathi

8

Hi @bharathi.a16

We are using API to create users into Auht0 using Management Token and another API call to attach role. I just am trying to see if I can avoid extra API call to assign role.

Ah, ok. So you are provisioning the users instead of them signing up to your App ?

Also, if I may ask… when we retrieve user information it does not show any roles attached to the user in the response. Is there a way we can get to see that info? apart from having it in user_metadata or app_metadata in the user profile.

What endpoint are you using ? Any endpoint in the Management API or userinfo ?

9

Yes, Thats right.

Using Get UserInfo API for retrieving User details.

10

Hi @mathiasconradt, what is the recommended way to obtain the role id? It’s not visible from the dashboard and the only way I could obtain it was to make a GET to the roles endpoint. Thanks.

11

@johnlim Yes, that’s the way to do it. I don’t see any other way either, unless you get it once from the endpoint and then hardcode it in the Rule (might not be the best approach when working with test/stag/prod environments).

12

@mathiasconradt Thanks for confirming. Ideally, it would allow using the name of the role, which would then easily work across the different build environments. Is this something you foresee being supported?

1 Like
13

how can i extract the id of the role, from the information mongodb brings me when i login?

14

To find the role id,

  1. Login to your Auth0 dashboard
  2. Click Users & Roles
  3. Click Roles
  4. Click a role
  5. Look at the URL in your browser. It will contain the role id. In the example below the role id would be rol_41eOpF31juqS0K

https://manage.auth0.com/dashboard/us/dev-######/roles/rol_41eOpF31juqS0K/settings

3 Likes
15

Thanks a lot for sharing that with the rest of community!

16

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.