Question about roles

[kkrp1]

Hi everyone,

I’m new to all this. Am I right that, to use roles (e.g. employee vs. employer) I need to install the Auth0 Authorization extension? I ask just because the docs for that seemed rather long-winded, just to implement something so simple as roles. Would a simpler approach be to just store arbitrary meta on my users, and then implement the “what sort of user are you” logic in my API, rather than leaving this to Auth0, or is there some simpler way?

[EDIT] - I’ve just seen that there’s also “roles” in the main A0 dashboard. Are these different roles from those goverened by/managed under the extension?

Again, I’m new, so go easy!

Many thanks

[tyf]

Hey again @kkrp1

@kkrp1

I’ve just seen that there’s also “roles” in the main A0 dashboard. Are these different roles from those goverened by/managed under the extension?

You can leverage Auth0 roles by either using the Authorization Core or the Authorization Extension - We generally recommend using Core Authorization and RBAC.

Once roles are assigned to users, you can add those as custom claims in tokens:

How to add Roles and Permissions to the ID Token using Actions?

Problem statement Is it possible to retrieve the user’s Roles and/or Permissions and include them in the JWT Token? Solution Yes, it’s possible to retrieve the user’s Roles and/or Permissions and append them to either the ID Token or Access Token. To do so, you must use a Post-Login Action script. 1.1 Roles When adding the user’s Roles to the token, call the event.authorization.roles property and add it as a custom claim to the Token. Please see here on creating namespaced custom claims. Be…

Hope this helps to clarify!

[kkrp1]

Hi again, @tyf - thanks a lot for this, I’ll take a look and dive into it.