# Password Owner Grant + Authorisation Extension **URL:** \ **Category:** Get Help\ **Tags:** authorisation-extne\ **Created:** [June 28, 2017, 4:39pm UTC](https://community.auth0.com/t/password-owner-grant-authorisation-extension/7304 "2017-06-28T16:39:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![chintanshah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chintanshah/32/7773_2.png) [@chintanshah](https://community.auth0.com/u/chintanshah)\ **Post date:** [June 28, 2017, 4:39pm UTC](https://community.auth0.com/t/password-owner-grant-authorisation-extension/7304/1 "2017-06-28T16:39:42Z")
I am using password owner grant flow to authenticate user and able to fetch access\_token successfully. In access\_token, i also want roles, group too. For this, i installed Authorisation Extension and also published rule (enabled toggle buttons for storing roles,group & permission into access\_token). Questions 1). Tried passing scope as mentioned in docs i.e groups,roles but when recevied access\_token got decrypted using JWT.io plugin , i found that groups,roles scope got ignored. ---
**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\ **Post date:** [June 28, 2017, 9:24pm UTC](https://community.auth0.com/t/password-owner-grant-authorisation-extension/7304/2 "2017-06-28T21:24:31Z")
Passing `roles` and `groups` as scopes will only automatically add that information (if available at the user level) to the issued ID token (never to the access token) **and only when the request is performed using a legacy authentication pipeline**. If you’re performing a request that returns an access token valid for your own API then you’re not using the legacy pipeline. The non-legacy pipeline strictly follows the OpenID Connect specification and does not include (not even for the ID token) the non-standard information about roles and groups as these are not standard claims defined by the spec. If you want to include custom information in the issued tokens (either ID token or access token) then you should check the reference documentation on how to [add custom claims](https://auth0.com/docs/api-auth/tutorials/adoption/scope-custom-claims#custom-claims). Basically, create a rule that runs after the rule that the authorization extension created and set custom claims in the issued tokens based on the information at the user object (placed by the extension rule); for example, `context.accessToken"https://myapp.example.com/roles"] = user.roles`. ---
**Author:** ![chintanshah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chintanshah/32/7773_2.png) [@chintanshah](https://community.auth0.com/u/chintanshah)\ **Post date:** [June 29, 2017, 8:04pm UTC](https://community.auth0.com/t/password-owner-grant-authorisation-extension/7304/3 "2017-06-29T20:04:56Z")
@jmangelo thanx for quick reply. As per your comment, i am able to get group,roles and permission into access\_token. With the same access\_token, i am calling my web-api (set up correctly by following [asp.net](http://asp.net) core web-api quickStart). But when debug, i am unable to find custom claims i.e. roles,group & permissions? As a result of which any method as below , wont be able to called. > [Authorize(Roles = “Admin”)] > @jmangelo :- can u plz provide me suggestions so that i can move further. ---
**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\ **Post date:** [July 5, 2017, 7:39pm UTC](https://community.auth0.com/t/password-owner-grant-authorisation-extension/7304/4 "2017-07-05T19:39:04Z")
The suggestion made was for the problem of including that data in the issued token. The problem of using `Authorize` attribute to automatically check the included data is specific to how the access token is being processed in the receiving API. IIRC, in .NET you can configure it to treat a custom claim as the source of roles information. For example, for a [ClaimsIdentity](https://msdn.microsoft.com/en-us/library/hh194484(v=vs.110).aspx) there’s a constructor that allows you to do it. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 2, 2018, 5:55am UTC](https://community.auth0.com/t/password-owner-grant-authorisation-extension/7304/5 "2018-03-02T05:55:01Z")