Easy way to put user role in JWT

[dan.woda]

@Civility

Though on the Sample Use Cases page above, I’m not sure if “If you enable RBAC for APIs and set the Token Dialect appropriately …” counts as “easy” (what’s the “Token Dialect”? it’s not linked; is it necessary to learn yet another concept? How does Firebase Auth manage to not require this?).

I think what the token dialect refers to is whether or not the token is an opaque token or a JWT. I agree, that is confusing. Token dialect is not something I have seen referred to often.

At this point, I am fully aware of your preference for firebase.

@Civility

I’ve enabled “Add Permissions in the Access Token”, added an “admin” permission to our API, added that “admin” permission to our “Admin” role, logged out from our web app, logged back in, and decoded the received idToken . But - it did not contain any permissions field. Any idea why? (the accessToken was something like xFgQCQFCGLbqM-MAvjBO4HTFoPsHTEDU , not a JWT).

As the feature says,

“Add Permissions in the Access Token”

As for why the AT is opaque, please see the linked doc above.

@Civility

BTW, I submitted a PR to clarify where the Token Dialect comes into play

Thanks for taking the time to do that!