# First time login missing permissions in the access token

**URL:** <https://community.auth0.com/t/first-time-login-missing-permissions-in-the-access-token/84494>\
**Category:** JWT.io\
**Tags:** jwt, login\
**Created:** [June 2, 2022, 7:18pm UTC](https://community.auth0.com/t/first-time-login-missing-permissions-in-the-access-token/84494 "2022-06-02T19:18:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjones1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jjones1/32/33352_2.png) [@jjones1](https://community.auth0.com/u/jjones1)\
**Post date:** [June 2, 2022, 7:18pm UTC](https://community.auth0.com/t/first-time-login-missing-permissions-in-the-access-token/84494/1 "2022-06-02T19:18:20Z")

</div>

Hello!

When a user logs in to our iOS app for the first time, the JWT access token does not contain any permissions until the second time they login.

From what I have read so far, it seems this is because the Auth0 actions have not fully completed by the time we receive the first access token on the frontend (iOS App).

I notice React or SPA web apps can resolve this easily via the Auth0 SDK by using a `getTokenSilently` function, however we don’t have something similar in the iOS SDK.

The solution we are considering is if the user’s permissions are empty, we make a request to renew a refresh token, which then contains the permissions we need because the Auth0 actions have completed.

Is there a better way of going about this? Are there any inherent risks to enabling refresh tokens (they are currently disabled) I might not be aware of?

Is it true the only way to receive a refresh token from the `/token` endpoint is to enable `Allow Offline Access` in the API Manager?

Other details:

1. We use Microsoft Active Directory for validating users
2. We use an ephemeral safari web view login window

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [June 2, 2022, 11:10pm UTC](https://community.auth0.com/t/first-time-login-missing-permissions-in-the-access-token/84494/3 "2022-06-02T23:10:29Z")

</div>

Hi there @jjones1 welcome to the community!

> [@jjones1](#):
>
> From what I have read so far, it seems this is because the Auth0 actions have not fully completed by the time we receive the first access token on the frontend (iOS App).

Are you attempting something like is outlined in this [FAQ](https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506) to add roles/permission to a user’s token? Which type of Action are you using?

> [@jjones1](#):
>
> The solution we are considering is if the user’s permissions are empty, we make a request to renew a refresh token, which then contains the permissions we need because the Auth0 actions have completed.
> 
> Is there a better way of going about this? Are there any inherent risks to enabling refresh tokens (they are currently disabled) I might not be aware of?

Refresh tokens are encouraged for native mobile apps and are considered a safe approach to improving the user experience. I recommend checking out both [this article](https://auth0.com/docs/secure/tokens/refresh-tokens#for-native-mobile-apps) as well as this [blog post](https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/) to learn more.

> [@jjones1](#):
>
> Is it true the only way to receive a refresh token from the `/token` endpoint is to enable `Allow Offline Access` in the API Manager?

That is correct - The only way a refresh token will be granted is if the `offline_access` scope is included in the authorize request.

Let us know!

---

<div class="post-metadata">

**Author:** ![jjones1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jjones1/32/33352_2.png) [@jjones1](https://community.auth0.com/u/jjones1)\
**Post date:** [June 2, 2022, 11:43pm UTC](https://community.auth0.com/t/first-time-login-missing-permissions-in-the-access-token/84494/4 "2022-06-02T23:43:31Z")

</div>

Thanks for those resources @ty.frith ! The information you shared was very helpful!

I apologize, I was incorrect when saying we use actions (not the Auth0 implementer, just the front end consumer). It appears we use `Auth Pipeline -> Rules` and execute a function to authenticate users.

Here is what our function looks like, are there any room for improvements we could make to allow the Role to be assigned to the access token the first time? Or would we need to migrate to actions?

I removed sensitive data, so it doesn’t _exactly_ match what we implement, but it’s essentially the same.

```auto
function authenticateUser(user, context, callback) {
  // Auto-populated by auth0-deploy-cli
  const groupsAllowed = {"A Group Key":["A collection of group values"]};
  const clientGroups = groupsAllowed[context.clientName] || [];

  const hasAccess = user.groups.some((group) => clientGroups.includes(group));
  if (!hasAccess) {
	return callback(
	  new UnauthorizedError("Access denied. You are not a member of an authorized group. Please contact your administrator.")
	);
  }

  const ManagementClient = require("auth0@2.27.0").ManagementClient;
  const management = new ManagementClient({
	domain: auth0.domain,
	token: auth0.accessToken,
	scope: 'read:roles update:users'
  });

  const params = { id: user.user_id };
  const data = { roles: [] };

  switch (context.clientName) {
	case "Platform 1":
	  data.roles.push(configuration.ROLE_1);
	  break;
	case "Platform 2":
	  data.roles.push(configuration.ROLE_2);
	  break;
	case "Platform 3":
	  if (user.groups.includes("Role 3")) {
		data.roles.push(configuration.ROLE_3);
	  }

	  if (user.groups.includes("Role 4")) {
		data.roles.push(configuration.ROLE_4);
	  }
	  
	  if (user.groups.includes("Role 5")) {
		data.roles.push(configuration.ROLE_5);
	  }

	  // A custom claim for mapping emails to certain locations
	  const namespace = "https://any-url.com/";
	  context.accessToken[namespace + 'email'] = user.email;
	  break;
	default:
  }

  management.assignRolestoUser(params, data, function (err) {
	if (err) {
	  return callback(new Error(err), user, context);
	}
	return callback(null, user, context);
  });
}

```

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [June 17, 2022, 11:43pm UTC](https://community.auth0.com/t/first-time-login-missing-permissions-in-the-access-token/84494/5 "2022-06-17T23:43:36Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [November 1, 2022, 8:38pm UTC](https://community.auth0.com/t/first-time-login-missing-permissions-in-the-access-token/84494/6 "2022-11-01T20:38:25Z")

</div>

Hey @jjones1 - Really sorry I never got back to you on this one, slipped through the cracks somehow 😕

For future reference, the code looks good to me - I would however like to point out that the Management API is [rate limited](https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/management-api-endpoint-rate-limits) so be aware of that.

Here’s an FAQ that may be of use as well:

[https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506](https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506)

Cheers!