Ideally I would like to have coarse-grained “roles” - reader, writer, admin - in the scope, then somewhere map those roles to fine-grained permissions and include those in the access token.
What is the best practice around mapping coarse-grained roles to fine-grained permissions and validating an access token against an API call’s required permissions? Should the access token contained the list o fine-grained privileges? Or is this mapping handled outside of the authorization flow?
As Auth0 provides Roles that map to a set of Permissions it seems like I should be able to make use of that during the user login flow.
Generally speaking, regarding API authorization, the Auth0 Identity Provider will issue a JWT access token containing the scope claim. The scope claim content is the intersection of:
-scopes requested by the client application with the /authorize request by specifying the scope query parameter and
-the user’s assigned permissions within the IdP (assigned directly to the user, or using Roles).
Your API performs a standard JWT access token validation and later checks the scope claim to see if it matches the permissions required for the endpoint being accessed. Take a look here: Validate Access Tokens.
These will have to be listed in the API settings in your Auth0 tenant:
The calling application should specify the scope needed. Auth0 IdP checks if the role assigned to the user covers the scopes requested. The scope claim returned in the access token should then be evaluated on the API side: does it contain all the permissions required to call the endpoint?
Does this clear the topic? Please let me know your thoughts or follow-up questions!
