Permissions not included in access token for MFA flow

[drew11]

@stephanie.chamblee

I just tried this out with a rule using the Guardian and also using email MFA, and I seem to be getting a role added to the token. I probably don’t have quite the same setting to recreate this. Which type of MFA are you using (email, phone message, Guardian, etc.)? Also, would you mind sending the code from your rule that adds the role/permissions array to the token?

Hi,

We are trying to use SMS for MFA. Currently without MFA, we do not use a rule to add permissions. In our settings for our API, we have the following settings on “Enable RBAC” and “Add Permissions in the Access Token.” Enabling those added a “permissions” key with all of the users permissions to the access key. However, when a user logins using MFA, that “permissions” key is missing.