How to give roles and permissions to users in a Python WebApp

[xmjoodi]

I’m developing a simple python web app that has two roles.
Let’s call them Role (A,B).
A permissions: [1,2,3]
B permissions: [4,5,6]

1. I want to be able to assign users a default role (A).
2. I want to be able to differentiate between the users that have signed.

In order to solve problem one, I assumed that any user that have signed into my web app by default is given a a default Role (A) by hitting the API management (expensive). In order to be of role B, you need to send a ticket for being of Role B (which is not what I really intend).

In order to solve problem two, I just use JWT to check permission. If permission (1) is there in JWT then I know user is of role (A) else user is of role (B).
However, in order to obtain JWT I ended up saving the “access token” in the session, which is terrible.

I wonder if there’s a way to give default roles to users and be able to differentiate between them that’s easy and secure.

Thanks in advance.

[stephanie.chamblee]

Hi @xmjoodi,

@xmjoodi

I want to be able to assign users a default role (A).

Here is an FAQ for adding a default role to the user:

How do I add a default role to a new user on first login?

Question: How do I assign a default role to a new user on first login? Answer: If you are using the Authorization Core, you can leverage the Management API in a rule to assign a role based on login count. Example Rule: function (user, context, callback) { const count = context.stats && context.stats.loginsCount ? context.stats.loginsCount : 0; if (count > 1) { return callback(null, user, context); } const ManagementClient = require('auth0@2.27.0').ManagementClient; …

Please let me know if you have additional questions about this.

@xmjoodi

I want to be able to differentiate between the users that have signed.

You can store the roles in a custom claim:
https://auth0.com/docs/scopes/sample-use-cases-scopes-and-claims#add-custom-claims-to-a-token

You’d then access the custom claim in the /userinfo request as described in the quickstart:
https://auth0.com/docs/quickstart/webapp/python/01-login#add-the-callback-handler

[xmjoodi]

Thank you @stephanie.chamblee that was really helpful.

Have a lovely day
Keep Authing