Auth0+Django Setting Roles and Permissions

[ovezovv]

When I implement Auth0 Authentication and “Set Roles to User” Rule

function (user, context, callback) {
  const namespace = 'https://dev-o0hx8kbg.us.auth0.com';
  const assignedRoles = (context.authorization || {}).roles;
  const assignedPermis = (user.app_metadata || {}).permissions;

  let idTokenClaims = context.idToken || {};
  let accessTokenClaims = context.accessToken || {};

  idTokenClaims[`${namespace}/roles`] = assignedRoles;
  accessTokenClaims[`${namespace}/roles`] = assignedRoles;
  idTokenClaims[`${namespace}/permissions`] = assignedPermis;
  accessTokenClaims[`${namespace}/permissions`] = assignedPermis;

  context.idToken = idTokenClaims;
  context.accessToken = accessTokenClaims;
  callback(null, user, context);
} 

When I am trying to jwt.decode, payload returns

Key Error at "https://dev-o0hx8kbg.us.auth0.com/roles"

Here is below my function in Django for retrieving payload

def get_user_details(self, response):
        # Obtain JWT and the keys to validate the signature
        id_token = response.get('id_token')
        audience = self.setting('SOCIAL_AUTH_AUTH0_KEY')  # CLIENT_ID
        jwks = request.urlopen(
            'https://' + self.setting('SOCIAL_AUTH_AUTH0_DOMAIN') + '/.well-known/jwks.json')
        issuer = 'https://' + self.setting('SOCIAL_AUTH_AUTH0_DOMAIN') + '/'

        payload = jwt.decode(id_token, jwks.read(), algorithms=[
                             'RS256'], audience=audience, issuer=issuer)

        return {
            'username': payload['nickname'],
            'first_name': payload['name'],
            'picture': payload['picture'],
            'user_id': payload['sub'],
            'role': payload['https://dev-o0hx8kbg.us.auth0.com/roles']
        }

[rueben.tiow]

Hi @ovezovv,

Welcome to the Auth0 Community!

I understand you encountered issues setting roles and permissions in the ID token using an Auth0 Rule.

After reviewing your Rule and error carefully, I noticed that you used a reserved namespaced, specifically with the auth0.com domain.

Please be aware that custom namespace claims must use any non-Auth0 HTTP or HTTPS URL as a namespace identifier. Auth0 domains cannot be used as namespace identifiers, and include:

• auth0.com
• webtask.io
• webtask.run

Create Custom Claims

Once the namespace value is fixed, you can get the users’ roles and permissions from the ID token.

Please let me know if there’s anything else I can do to help.

Thank you.

[ovezovv]

@ovezovv

            'roles': payload['http://sample-web.com/api/v2/roles']

With changing as well as you mentioned, from this API identifier I can get the all permissions and roles, What if I try to get the currently signed-in user’s permissions and roles, how should I implement the rule or is there any specific configuration for that, thanks in advance.

[rueben.tiow]

Hi @ovezovv,

Thank you for your response.

@ovezovv

What if I try to get the currently signed-in user’s permissions and roles, how should I implement the rule or is there any specific configuration for that, thanks in advance.

The Rule snippet you shared with me will get the permissions and roles of the user Post-Login and append them to the ID Token. There should not be any additional configuration needed.

You could alternatively use the Management API v2 Get a user Role endpoint and Get a user Permissions endpoint to accomplish the same results.

Hoped this helps!

Please do not hesitate to reach out if you have any further questions.

Thank you.