# Custom scopes/permissions not included in access token from Okta IdP

**URL:** <https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617>\
**Category:** Get Help\
**Tags:** oidc-enterprise-connection, connections\
**Created:** [May 7, 2024, 5:37pm UTC](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617 "2024-05-07T17:37:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![darrenk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/darrenk/32/56850_2.png) [@darrenk](https://community.auth0.com/u/darrenk)\
**Post date:** [May 7, 2024, 5:37pm UTC](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617/1 "2024-05-07T17:37:10Z")

</div>

Hi,  
In Auth0 I have configured:

- A Custom API with 18 permissions.
- A Next.js client that calls the API.
- A SPA Auth0 application with an “enterprise connection” to an Okta OIDC IdP.
- An enterprise connection to an Okta OIDC IdP.
- The Okta OIDC application.

Login succeeds but the token exchange does not include my custom scopes/permissions in the access token.

OIDC connection in Auth0:

 ![OIDC connection in Auth0](https://global.discourse-cdn.com/auth0/original/3X/2/e/2ebe0c904884b691037fb28a32dd62b0c3ed738f.png)

Okta scopes:

 ![Okta scopes](https://global.discourse-cdn.com/auth0/original/3X/e/2/e25676fd930728595b564df1b41bb1fa6a459225.png)

This is the access token sent to the API:

```auto
{
  "iss": "https://bookend-mvp-staging.us.auth0.com/",
  "sub": "oidc|Bookend-Okta-OIDC-SSO|00uezee7dbLsmw0kB5d7",
  "aud": [
    "https://control-plane-pwuhwxrqnq-uc.a.run.app",
    "https://bookend-mvp-staging.us.auth0.com/userinfo"
  ],
  "iat": 1715053960,
  "exp": 1715140360,
  "scope": "openid profile email",
  "org_id": "org_pOdZ283uSzKQpddI",
  "azp": "PmuiEJVHdJVj3xaAqn4z0HCOXDhbbqyU",
  "permissions": []
}

```

I have assigned the permission to the user:

 ![Screen Shot 2024-05-07 at 11.34.13 AM](https://global.discourse-cdn.com/auth0/original/3X/6/c/6c015f55fe7bbbc30dbbb8f5aa6830edf25821bc.png)

How do I get my custom scopes/permissions into the access token sent from Okta?

---

<div class="post-metadata">

**Author:** ![darrenk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/darrenk/32/56850_2.png) [@darrenk](https://community.auth0.com/u/darrenk)\
**Post date:** [May 7, 2024, 6:00pm UTC](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617/3 "2024-05-07T18:00:58Z")

</div>

I see the authorize request does include the custom scopes:

```auto
https://dev-11895766.okta.com/oauth2/default/v1/authorize?client_id=0oag2l3qnrCNVqJDs5d7&scope=datasets%3Aread%20datasets%3Ascan%20datasets%3Awrite%20email%20models%3Adelete%20models%3Aread%20models%3Awrite%20openid%20profile&response_type=code&redirect_uri=https%3A%2F%2Fbookend-mvp-staging.us.auth0.com%2Flogin%2Fcallback&login_hint=darren%40bookend.ai&response_mode=query&code_challenge=...&code_challenge_method=S256&state=...

```

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 7, 2024, 9:42pm UTC](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617/4 "2024-05-07T21:42:39Z")

</div>

Hey @darrenk!

I see that there’s an `org_id` in the access token shared, are the permissions assigned directly to the user or by way of an organization? The following post explains the difference well and why you aren’t seeing any permissions in the `permissions` claim:

> [@Permission claim empty if logging on using Organization - still unresolved](https://community.auth0.com/t/permission-claim-empty-if-logging-on-using-organization-still-unresolved/97845/3):
>
> Hi @PatrickHeneise Thanks for reaching out to the Auth0 Community! My apologies for not getting back to you sooner. And yes, normally topics are automatically closed after 15 days from the last reply. Now, after my investigation, I found that there were no issues with getting the permissions added to the access token when authenticating with Organizations. I believe what happened involved the user only being assigned to those Permissions globally on their user profile (non-organization), in…

---

<div class="post-metadata">

**Author:** ![darrenk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/darrenk/32/56850_2.png) [@darrenk](https://community.auth0.com/u/darrenk)\
**Post date:** [May 7, 2024, 9:45pm UTC](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617/5 "2024-05-07T21:45:25Z")

</div>

That was the problem.  
I added the role to the user at the organization level (in Auth0) and it is working now.

The scopes in the IdP (Okta) were not needed.

Thanks for your help!  
-Darren

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 7, 2024, 9:48pm UTC](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617/6 "2024-05-07T21:48:29Z")

</div>

Ah, great! Thanks for confirming 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 21, 2024, 9:49pm UTC](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617/7 "2024-05-21T21:49:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.