# Retrieving roles from token in Razor page app

**URL:** <https://community.auth0.com/t/retrieving-roles-from-token-in-razor-page-app/110700>\
**Category:** Get Help\
**Tags:** identifier-first, login-experience\
**Created:** [July 6, 2023, 4:39pm UTC](https://community.auth0.com/t/retrieving-roles-from-token-in-razor-page-app/110700 "2023-07-06T16:39:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jbaynham](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jbaynham](https://community.auth0.com/u/jbaynham)\
**Post date:** [July 6, 2023, 4:39pm UTC](https://community.auth0.com/t/retrieving-roles-from-token-in-razor-page-app/110700/1 "2023-07-06T16:39:47Z")

</div>

Hi,

I’ve been following the article at [https://auth0.com/blog/securing-razor-pages-applications-with-auth0/](https://auth0.com/blog/securing-razor-pages-applications-with-auth0/), and looking at how user details are pulled out of the token (the example shows email being extracted by adding

options.Scope = “openid profile email”;

to AddAuth0WebAppAuthentication.)

I have added an action to add the roles to the token. How would I go about retrieving these roles, and how could I use them in the standard [Authorize] flow?

---

<div class="post-metadata">

**Author:** ![jbaynham](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jbaynham](https://community.auth0.com/u/jbaynham)\
**Post date:** [July 10, 2023, 12:43pm UTC](https://community.auth0.com/t/retrieving-roles-from-token-in-razor-page-app/110700/2 "2023-07-10T12:43:57Z")

</div>

So, I can get the details of the Auth0 roles assigned by querying the Claims collection of the User object. I am still unclear how to convert this is into a Role that the User belongs to when queried with User.IsInRole(“rolename”), or so it is usable in policy-based authorization e.g. via a policy like

```auto
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("RequireAdministratorRole",
         policy => policy.RequireRole("Administrator"));
});

```

---

<div class="post-metadata">

**Author:** ![jbaynham](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jbaynham](https://community.auth0.com/u/jbaynham)\
**Post date:** [July 10, 2023, 1:51pm UTC](https://community.auth0.com/t/retrieving-roles-from-token-in-razor-page-app/110700/3 "2023-07-10T13:51:33Z")

</div>

Looking at an example from the Github for auth0.aspnetcore.authentication, the roles have to be added into the token in a specific way to be recognised by [asp.net](http://asp.net). It gives details of a rule:

```auto
function (user, context, callback) {
  const assignedRoles = (context.authorization || {}).roles;
  const idTokenClaims = context.idToken || {};

  idTokenClaims['http://schemas.microsoft.com/ws/2008/06/identity/claims/role'] = assignedRoles;

  context.idToken = idTokenClaims;

  callback(null, user, context);
}

```

Presumably this would have to be rewritten as an Action, any clues what this should look like, please?

---

<div class="post-metadata">

**Author:** ![jbaynham](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jbaynham](https://community.auth0.com/u/jbaynham)\
**Post date:** [July 11, 2023, 10:28am UTC](https://community.auth0.com/t/retrieving-roles-from-token-in-razor-page-app/110700/4 "2023-07-11T10:28:27Z")

</div>

For reference, I rewrote this as

````auto
exports.onExecutePostLogin = async (event, api) => {
  const assignedRoles = (event.authorization || {}).roles;
  
  if (event.authorization) {
    api.idToken.setCustomClaim('http://schemas.microsoft.com/ws/2008/06/identity/claims/role', assignedRoles);
    api.accessToken.setCustomClaim('http://schemas.microsoft.com/ws/2008/06/identity/claims/role', assignedRoles);
  }
}
``` and it works as required.
````

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 25, 2023, 10:28am UTC](https://community.auth0.com/t/retrieving-roles-from-token-in-razor-page-app/110700/5 "2023-07-25T10:28:33Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.