Merge scope and permissions in scope in a rule

[a.sanino]

Hello everybody,

As in subject, I have the need to merge in a rule scope and permissions in the scope member of the access token

{
    "scope" : "openid profile email",
    "permissions" : [ "do:something-cool" ]
}
// to
{
    "scope" : "openid profile email do:something-cool"
}

more particularly, I don’t find at all any reference to the permissions array in any rule, but I have it in the final access token.
so far i have tried everything and I cannot find an answer, can anyone help?

[nicolas_sabena]

Hi @a.sanino

As it stands right now, the RBAC core does not provide access to the calculated permissions on the context object while rules execute, so you’ll have to do the merge in your app/API when processing the token.

While not exactly what you are after, if you set the API like this:

the scope will be the intersection of scopes requested and permissions allowed for the user. But the client application still needs to requests all the scopes it wants and then get only the scopes allowed for the user.

[a.sanino]

Thank you, this perfectly solves my problem

[mathiasconradt]

Related, however I’m marking Nicolas answer as solution for now, since it solved the OP problem:

Permissions: claim or scopes

I am a little confused on best practices in dealing with API permissions. I understand that in the API within Auth0, I can configure it to always attach the permissions claim to the access token. I am confused because I was under the understanding that the spec defines the scopes claim as the place to define a users permissions. My objective is to have the permissions always included in the access token. I would think you ca achieve this with a rule to automatically add them (although it looks …

How can I get permissions into my scope in the access token?

I am using an AWS HTTP API with a JWT Authorizer. The JWT Authorizer can check the “scope” part of the access token to allow execution of the HTTP API endpoint. The scopes defined in the authorizer check the “scope” portion of the access token - if it finds the scope in the access token it allows the client to executed the endpoint. My Auth0 user has a set of permissions - are they “scopes”? It’s not clear, but these permissions do show up in the access token as an array in the “permissions” pa…