# Delegated Admin Extension rule/action namespace

**URL:** <https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289>\
**Category:** Get Help\
**Created:** [September 27, 2021, 8:31am UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289 "2021-09-27T08:31:52Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![serpa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/serpa/32/12977_2.png) [@serpa](https://community.auth0.com/u/serpa)\
**Post date:** [September 27, 2021, 8:31am UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/1 "2021-09-27T08:31:52Z")

</div>

Hey there, I’ve been implementing the “Delegated Admin Extension” by following the docs [here](https://auth0.com/docs/extensions/delegated-administration-extension).

In the step “Add user roles to the DAE namespace in the ID Token using this rule”, I’m not using a rule but an action, and I don’t understand which `namespace` we should use for it.

My example is:

```javascript
exports.onExecutePostLogin = async (event, api) => {
  if (event.client.client_id === '<CLIENT_ID>') {
    if (event.authorization) {
      const namespace = 'https://<TENANT_NAME>.eu12.webtask.io/auth0-delegated-admin';
      api.idToken.setCustomClaim(namespace, { roles: event.authorization.roles });
    }
  }
};

```

This above does not work because the namespace is somehow not accepted. I’ve checked [this](https://auth0.com/docs/security/tokens/json-web-tokens/create-namespaced-custom-claims) docs and it says:

> - Use any non-Auth0 HTTP or HTTPS URL as a namespace identifier. Auth0 domains cannot be used as namespace identifiers, and include:
> - [auth0.com](http://auth0.com)
> - [webtask.io](http://webtask.io)
> - webtask.run

I’ve noticed that if I put anything else as the namespace, it works, for example: `https://something.com/auth0-delegated-admin`.

What should be the correct value?

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [September 27, 2021, 7:17pm UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/3 "2021-09-27T19:17:56Z")

</div>

Hi @serpa,

Thanks for reaching out to the Auth0 Community!

That’s is correct. Our documentation states that you will not be able to use a namespace that includes:

- [auth0.com](http://auth0.com)
- [webtask.io](http://webtask.io)
- webtask.run

These namespace identifiers are reserved and prevent custom claims from conflicting with the list of standardized claims defined by the OIDC specification.

And, having looked closely at your namespace identifier, it appears that you used your Auth0 domain name as part of the URL. The correct value that you should set should look something similar to:

```auto
https://example.com/auth0-delegated-admin

```

Instead of using `example.com`, you can use your own uniquely defined namespace identifier in the URL.

Doing so will add user roles to the DAE namespace in the ID token.

Please let me know if there are any questions. I’d be happy to help.

Thank you.

---

<div class="post-metadata">

**Author:** ![serpa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/serpa/32/12977_2.png) [@serpa](https://community.auth0.com/u/serpa)\
**Post date:** [September 28, 2021, 8:18am UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/4 "2021-09-28T08:18:10Z")

</div>

Hey @rueben.tiow, thanks for your response.

I’m still not sure what do you mean with:

> Instead of using `example.com` , you can use your own uniquely defined namespace identifier in the URL.

What would be my uniquely defined namespace?  
Shouldn’t the namespace be the target application URL?

From my experience, I thought the application only accepted a claim that is namespaced with its URL (or audience?). But I may be wrong, if you can point me to the correct understanding, I would be appreciated!

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [September 28, 2021, 10:12pm UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/5 "2021-09-28T22:12:35Z")

</div>

Hi @serpa,

> [@serpa](#):
>
> What would be my uniquely defined namespace?

In short, you need to use a URI as the namespace for custom claims. Note that using any arbitrary identifier can remove the custom claims from the token if there’s a conflict with the same namespace.

As stated in our [docs](https://auth0.com/docs/security/tokens/json-web-tokens/create-namespaced-custom-claims):

- Use a URL that you control as a namespace identifier; this allows you to avoid the risk that someone else is using the same namespace. The namespace URL does not have to point to an actual resource. It is only used as an identifier; it will not be called.

Therefore, your namespace should be in the format:

`https://YOUR_APP.com/auth0-delegated-admin`

---

<div class="post-metadata">

**Author:** ![serpa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/serpa/32/12977_2.png) [@serpa](https://community.auth0.com/u/serpa)\
**Post date:** [October 1, 2021, 8:19am UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/6 "2021-10-01T08:19:46Z")

</div>

Hey @rueben.tiow !

Thanks for your response.

I still don’t get it quite well.  
It seems I can put anything I want in the `namespace`. What would forbid me to put `https://google.com/auth0-delegated-admin`?

Right now I have it working with a domain I don’t control which is:

```bash
https://example.com/auth0-delegated-admin

```

* * *

I understand that auth0 says I should use a domain I control, but what if I don’t? What happens? Can I interfere with someone who owns that domain? What if someone users `serpa.com` (let’s imagine this is my domain) for their namespace?

Thanks and I hope you can understand my doubts!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [October 6, 2021, 1:30pm UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/8 "2021-10-06T13:30:01Z")

</div>

Previous message was deleted due to SPAM reasons.

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [October 6, 2021, 10:33pm UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/9 "2021-10-06T22:33:17Z")

</div>

Hi @serpa,

Thank you for your response and, I’m sorry for the delayed reply.

I understand your concerns and, thank you for asking these clarifying questions.

First, nothing is stopping you from using `https://google.com/auth0-delegated-admin` as your namespace.

However, let me clarify namespaces in more detail.

Generally, namespaces are invented names, typically using your registered domain to avoid possible collisions with standard OIDC claims.

Of course, it is possible for anyone to coincidentally invent and use the same namespace as you (i.e `https://www.serpa.com/`), however, this is typically not best practice and would run the risk of namespace collisions.

For example, if someone does decide to hijack a namespace, then they run the risk of breaking the interoperability between systems exchanging JWT for authorization.

As defined by the [JWT specification](https://datatracker.ietf.org/doc/html/rfc7519#section-4), namespaces are required to be unique (collision-resistant) to prevent name collisions, including the reserved namespaces defined by Auth0, specifically, `auth0.com`, `webtask.io`, and `webtask.run`.

Hoped this helps! Please let me know if there are any questions.

Thank you.

---

<div class="post-metadata">

**Author:** ![serpa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/serpa/32/12977_2.png) [@serpa](https://community.auth0.com/u/serpa)\
**Post date:** [October 7, 2021, 9:04am UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/10 "2021-10-07T09:04:19Z")

</div>

Hey @rueben.tiow !

I think I’ve understood!

Thanks a lot for clarifying it!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 22, 2021, 9:04am UTC](https://community.auth0.com/t/delegated-admin-extension-rule-action-namespace/70289/11 "2021-10-22T09:04:54Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.