How to get app_metadata and user_metadata THE RIGHT WAY

[cdelgado]

Hi,

I’ve been reading many posts and tutorials (thanks for the effort, they are great!), but I didn’t found any single one that said: If you want to get/set app_metadata and user_metadata, without breaking the OIDC standard, this is how it’s done.

Because many of the tutorials/answers solutions was to break the OIDC compliance using rules, like if there is no other way…

My context is: I have a SPA in Angular and a Lambda backend of nodejs functions.

And the simple question is:
How can I get the app_metadata and the user metadata in the backend without breaking the OIDC standard?

I guess it should be done using the management API, but again, it’s not clear to me how to create an API the right way.

Thanks
Carlos

How to access app_metadata when user logs in

Hello there, i’m trying to access the app_metadata & user_metadata field on the user object when a user is authenticated. I would like to know the best way to have this work.

How can I make app_metadata available in /userinfo endpoint?

We have a very detailled level of authorization set-up for our API. Currently using the authorization-extension of auth0 to manage all of these authorizations. It can very well be that a single user receives up to 20 groups, 10 roles and 100 permissions. We need all of this information available in the API to do granular authorization. However, placing all of this information in the token could generate very large tokens, which the documentation also discourages. So, instead, we’ve turned the ‘P…

[dan.woda]

Hi @cdelgado,

Welcome to the Auth0 Community Forum!

There are multiple ways to achieve this. You can add the claims to the token via OIDC conformant custom claims:

OpenID Connect Scopes

Or request them from the management api in the backend like you described.

Hope this helps!

Thanks,
Dan