# First login doesn't include permissions using post login action

**URL:** <https://community.auth0.com/t/first-login-doesnt-include-permissions-using-post-login-action/117237>\
**Category:** Get Help\
**Tags:** user-authorization-rbac, directory-authorization\
**Created:** [September 27, 2023, 12:09pm UTC](https://community.auth0.com/t/first-login-doesnt-include-permissions-using-post-login-action/117237 "2023-09-27T12:09:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alin.tatu](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@alin.tatu](https://community.auth0.com/u/alin.tatu)\
**Post date:** [September 27, 2023, 12:09pm UTC](https://community.auth0.com/t/first-login-doesnt-include-permissions-using-post-login-action/117237/1 "2023-09-27T12:09:24Z")

</div>

Hello,

I saw this situation happening through the forum but I couldn’t find an appropriate solution to my problem.

I have an action that assign user role after the first login.

```auto
exports.onExecutePostLogin = async (event, api) => {
    if (event.stats.logins_count !== 1) {
        return;
    }

    const ManagementClient = require('auth0').ManagementClient;

    var management = new ManagementClient({
        domain: 'MY_DOMAIN',
        clientId: 'MY_MANGEMENT_CLIENT_ID',
        clientSecret: event.secrets.CLIENT_SECRET,
        scope: 'read:roles update:roles',
        audience: 'MY_AUDIENCE'
    });

    const params = {
        id: event.user.user_id
    };
    const data = {
        "roles": ['MY_ROLE']
    };
    if (event.client.client_id === "MY_CLIENT_ID") {
        management.users.assignRoles(params, data, (err, user) => {
            if (err) {
                console.log(err.message);
            } else {
                console.log('user role assigned');
            }
        });
    }
};

```

Now this successfully assign the role to the user.  
But on client side just after the login is performed a HTTP request is made to get the oAuth token to https://MY\_DOMAIN.eu.auth0.com/oauth/token .

This token doesn’t have any permissions:

```auto
{
  "iss": "https://MY_DOMAIN.eu.auth0.com/",
  "sub": "google-oauth2|117559359790633501933",
  "aud": [
    "https://MY_AUDIENCE/",
  ],
  "iat": 1695811096,
  "exp": 1695897496,
  "azp": "yIKsGOF4X2tXr0noeTj2J9uSBcmWn8jF",
  "scope": "openid profile email offline_access",
  "permissions": [
  ]
}

```

But if I try to login again it will have the permissions.

How can I have the permission in the first login token response?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [September 28, 2023, 10:16pm UTC](https://community.auth0.com/t/first-login-doesnt-include-permissions-using-post-login-action/117237/3 "2023-09-28T22:16:15Z")

</div>

Hey there @alin.tatu welcome to the community!

Thanks for the detailed description of the issue 🙂

That’s odd those permissions aren’t coming through - I am using the same Action code and registering a `google-oauth2` user and I can’t seem to reproduce this 🤔 That is, the permissions are present in the access token as expected. Does this happen consistently? Are the permissions ever available?

One option/workaround is to force [silent auth](https://auth0.com/docs/authenticate/login/configure-silent-authentication) which would then add the permissions if they aren’t available already. Important to note, you would need to set `cacheMode: 'off'` in get [getTokenSilentlyOptions](https://auth0.github.io/auth0-react/interfaces/GetTokenSilentlyOptions.html#cacheMode) in `auth0-react` for example.

---

<div class="post-metadata">

**Author:** ![alin.tatu](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@alin.tatu](https://community.auth0.com/u/alin.tatu)\
**Post date:** [October 9, 2023, 3:27pm UTC](https://community.auth0.com/t/first-login-doesnt-include-permissions-using-post-login-action/117237/4 "2023-10-09T15:27:23Z")

</div>

Hi @ty.frith thanks for you answer, and sorry for the late reply.

The permissions are present only after the 2nd login, or using the refresh\_token to get a new token.  
But I wonder why they are not present on the access\_token I get just after the 1st login?

I would prefer not to go with the silent auth methods as it will complicate my workflow.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 14, 2023, 1:42am UTC](https://community.auth0.com/t/first-login-doesnt-include-permissions-using-post-login-action/117237/5 "2023-11-14T01:42:52Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.