# Authorization Extension: Persistence Missing After OAuth Token

**URL:** <https://community.auth0.com/t/authorization-extension-persistence-missing-after-oauth-token/7329>\
**Category:** Get Help\
**Tags:** authorization-extens, oauth\
**Created:** [June 29, 2017, 9:46pm UTC](https://community.auth0.com/t/authorization-extension-persistence-missing-after-oauth-token/7329 "2017-06-29T21:46:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmm5t](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rmm5t/32/7027_2.png) [@rmm5t](https://community.auth0.com/u/rmm5t)\
**Post date:** [June 29, 2017, 9:46pm UTC](https://community.auth0.com/t/authorization-extension-persistence-missing-after-oauth-token/7329/1 "2017-06-29T21:46:56Z")

</div>

I’m seeing strange behavior with the Authorization Extension’s Persistence feature between logins that happen via the Lock widget and logins that happen via a “Resource Owner Password” `access_token` request.

When a user logs in via the Lock widget, the `app_metadata` properly fills in with the authorization persistence settings ( `groups`, `roles`, `permissions`), but after a `POST /oauth/token` for that same user, only the `groups` authorization settings remain in the `app_metadata`. The `roles` and `permissions` values are emptied. Not until the user again logs in via the Lock widget do these values fill back in.

This was very much unexpected. Any ideas?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:55am UTC](https://community.auth0.com/t/authorization-extension-persistence-missing-after-oauth-token/7329/2 "2018-03-02T05:55:04Z")

</div>