Permissions not included in access token for MFA flow

Get Help
3

Hi @drew11,

Welcome to the Community!

I just tried this out with a rule using the Guardian and also using email MFA, and I seem to be getting a role added to the token. I probably don’t have quite the same setting to recreate this. Which type of MFA are you using (email, phone message, Guardian, etc.)? Also, would you mind sending the code from your rule that adds the role/permissions array to the token?

My rule that adds the role to the ID Token and Access Token:

function (user, context, callback) {
  const namespace = 'http://demozero.net';
  const assignedRoles = (context.authorization || {}).roles;

  let idTokenClaims = context.idToken || {};
  let accessTokenClaims = context.accessToken || {};

  idTokenClaims[`${namespace}/roles`] = assignedRoles;
  accessTokenClaims[`${namespace}/roles`] = assignedRoles;

  context.idToken = idTokenClaims;
  context.accessToken = accessTokenClaims;

  callback(null, user, context);
}

Thanks!