RBAC permissions for SPA app and API

[valentin1]

Hello,

First some backgorund on our setup:
We have a SPA + API + machine to machine app. We want to assign roles to users and decide which API endpoints the frontend can call based on that.

So we have RBAC setup with a role with some permissions. This seems to add the scopes in a permissions property in the token used to call the API. We then use GitHub - auth0/express-jwt-authz: Validate the JWT scope to authorize access to an endpoint to check that the required permissions are there.

So far so good.

We then try to call the API using a machine-to-machine app token. We set the required scopes from the dashboard. The problem is that the permissions are now stored in the scope field in the token.

The library that we use to check the permissions express-jwt-authz can only check one single field for permissions and the permissions for a SPA and a machine to machine app are stored in different places.

This can be easily fixed by us writing our own middleware to check either the scopes field or permissions field but what concerns us is that there is an inconsistency and this really feels like a workaround.

Are we missing something?

[mathiasconradt]

This question seems to be related to this one, therefore linking:

Permissions: claim or scopes

I am a little confused on best practices in dealing with API permissions. I understand that in the API within Auth0, I can configure it to always attach the permissions claim to the access token. I am confused because I was under the understanding that the spec defines the scopes claim as the place to define a users permissions. My objective is to have the permissions always included in the access token. I would think you ca achieve this with a rule to automatically add them (although it looks …