Permissions with application name

[filipebrius]

I have a VUE js SPA application using auth0, the implementation is pretty basic, but when I get the user information from auth0, instead of a “permissions” key, it returns a “{{some-of-my-auth0-applications-api-name}}/permissions”. I can’t find inside the auth0 dashboards how to change it.

Does anyone know how to change/fix it?

Vue.use(auth0Plugin, {
  domain: process.env.VUE_APP_AUTH0_DOMAIN,
  clientId: process.env.VUE_APP_AUTH0_CLIENT_ID,
  audience: process.env.VUE_APP_AUTH0_AUDIENCE,
  onRedirectCallback: (appState: any) => {
    router.push(appState && appState.targetUrl ? appState.targetUrl : window.location.pathname);
  },
});

By the way for my vue application, I’m not using the bfp_customers_report API/audience, but the Msgops one. So I can’t understand why it returns with the bfp_customers_report/permissions as a key inside my user’s details.

[tyf]

Hey there @filipebrius welcome to the community!

@filipebrius

I can’t find inside the auth0 dashboards how to change it.

Does anyone know how to change/fix it?

The permissions in the ID token with use of a namespace as pictured are added as a custom claim by a Rule or Action in your dashboard - You won’t be able to use the permissions claim directly in ID tokens as it’s a restricted claim. So, the way you are going about adding permissions to ID tokens currently is correct:

Adding user permission to the id-token

Hi I’ve got a react application and a backend project which exposes some APIs. I’ve assigned some roles to the users and some permissions to those roles. I have access to the permissions in my access token, so the backend project can authorize the user based on the permissions. But I need those permissions in the SPA too. For example the user should not be able to see the “edit post” button if he doesn’t have post:edit permission. Of course I can parse the access token payload in the SPA and …

Permissions are added using the permissions claim in access tokens as part of RBAC:

https://auth0.com/docs/get-started/apis/enable-role-based-access-control-for-apis