# Cannot get authorization (roles, permissions) data in user data

**URL:** <https://community.auth0.com/t/cannot-get-authorization-roles-permissions-data-in-user-data/22411>\
**Category:** Get Help\
**Tags:** api-authorization, idtoken, authorization, permissions, roles\
**Created:** [March 11, 2019, 8:37am UTC](https://community.auth0.com/t/cannot-get-authorization-roles-permissions-data-in-user-data/22411 "2019-03-11T08:37:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![huyennbl](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/huyennbl/32/14067_2.png) [@huyennbl](https://community.auth0.com/u/huyennbl)\
**Post date:** [March 11, 2019, 8:37am UTC](https://community.auth0.com/t/cannot-get-authorization-roles-permissions-data-in-user-data/22411/1 "2019-03-11T08:37:55Z")

</div>

Hello, I’m trying to get an account’s roles and permissions then add them to idToken as custom claims. But it seems like I missed something or misconfigured so authorization extension doesn’t work as I expected. Please help

What I’ve done:

1. Create an API named ‘New API’. A machine-to-machine app was also created automatically after this step.

2. Define scopes of New API, including ‘read:data’, ‘create:data’, ‘delete:data’.  

3. Install authorization extension.

4. Create permissions with names exactly same as scope names in step 2  

5. Create role ‘New API Manager’ with all 3 permissions created in step 4.  

6. Create a group named ‘KMS’.

7. Add an user to role ‘New API manager’ and group ‘KMS’

8. In Authorization configuration, enable token contents ‘groups’, ‘roles’, ‘permissions’. Then Publish Rule  

9. Add new rule with following code:

10. When I try to login with the user in step 7, I check the rule log in ‘Debug rule’, and here’s the information. The question is why am I only receiving ‘groups’, while ‘roles’ and ‘permissions’ fields are empty arrays  

Here’s the user I logged in

 ![49%20PM](https://global.discourse-cdn.com/auth0/original/2X/7/788ae4fc49a1796ce017996cb6d26d8a62ff79c9.png)

Here’s the idToken payload

 ![25%20PM](https://global.discourse-cdn.com/auth0/original/2X/1/1fb7a0f48ad7a51d62a95fc4885280d3699cd3cc.png)

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [March 11, 2019, 10:55am UTC](https://community.auth0.com/t/cannot-get-authorization-roles-permissions-data-in-user-data/22411/2 "2019-03-11T10:55:13Z")

</div>

Hey there @huyennbl!

I’ve managed to reproduce what you wanted to achieve step by step. It seems like you’ve chosen the wrong application when setting up roles and permissions which I also confirmed using our internal admin tools. Here’s the doc reference:

> **[Set Up Users in Authorization Extension Dashboard](https://auth0.com/docs/customize/extensions/authorization-extension/set-up-authorization-extension-users)**
>
> Learn how to set up users, groups, roles, and permissions in the Authorization Extension Dashboard.

**Looking at this doc** : “The roles that you will create will depend on the access to certain permissions in your application”

You also need to take care of the fact that you need to initiate the login flow from the same application.

Let me know if that work for you!

---

<div class="post-metadata">

**Author:** ![huyennbl](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/huyennbl/32/14067_2.png) [@huyennbl](https://community.auth0.com/u/huyennbl)\
**Post date:** [March 12, 2019, 2:56am UTC](https://community.auth0.com/t/cannot-get-authorization-roles-permissions-data-in-user-data/22411/4 "2019-03-12T02:56:58Z")

</div>

Thanks for your support, I’m not sure what you mean by ‘chosen wrong application’ because I have only 1 option.  
I tried removed all the app, api, roles settings, then do it again, and now it works.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [March 12, 2019, 11:04am UTC](https://community.auth0.com/t/cannot-get-authorization-roles-permissions-data-in-user-data/22411/5 "2019-03-12T11:04:32Z")

</div>

okok glad to hear that! Thought you have multiple apps set for testing purposes and that you’ve just not chosen the right one.

Stoked it worked for you in the end!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 27, 2019, 11:04am UTC](https://community.auth0.com/t/cannot-get-authorization-roles-permissions-data-in-user-data/22411/6 "2019-03-27T11:04:35Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.