Group Id verification in backend API

[rwa]

Hi,

Is there a way to add the Group Id to the access token in a rule/action?

My backend api needs to restrict the data returned based on the user’s group(s).
The default rule for adding groups from the authorization extension only adds the group name rather than the group id.
While helpful, this could lead to problems as the group name could easily change.

I would use organizations and organization id, but this is restricted to the Enterprise plan so that is out.

Are there any other/better options than either:

1. Make an additional authorization extension api call in the custom rule to retrieve the user’s groups, parse the returned id’s, and add a custom claim

Or:

2. Have the backend API make calls to the authorization extension ‘api/groups’ endpoint to get a list of all group names/ids and then map the group names received on the access token to the appropriate group id

I found related questions, but no real answers:

How to access group id in rule

I’m using the Auth0 Authorization Extension to implement the concept of “teams” in our app. Currently I’m able to include user groups in the id_token by enabling Groups in the Token Contents section of the authorization extension. The problem is group names are mutable and I would like to include the group id, which is immutable. To do this I tried making a rule that accessed user.groups, but that was just a list of names. Does anyone have advice on how to get access to the group ids in a rule?…

Looking for clarification on Authorization Extension API Groups

I have spent the better part of the day trying to figure out how we can map a group as an owner of a few entities in our DB which ultimately lead me to first getting some claims to pass through about the user. All I am really trying to do is get the groups array to populate within custom claim on the IdToken passed to the client. The default extension rule is capable of this, but references the groups by name, which strikes me as extremely odd, since anyone with access to the dashboard can manu…

Thanks

[dan.woda]

Hi @rwa,

Welcome to the Auth0 Community!

Thanks for posting a really well-thought-out question. You’ve mentioned the two approaches that I would have suggested.

Unfortunately, there is no silver bullet here, and you will have to implement one of the solutions you described. Let me know if you have any specific questions about it.