# Role based access control in applications

**URL:** <https://community.auth0.com/t/role-based-access-control-in-applications/135203>\
**Category:** Get Help\
**Tags:** configuration, application\
**Created:** [May 29, 2024, 1:06pm UTC](https://community.auth0.com/t/role-based-access-control-in-applications/135203 "2024-05-29T13:06:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![manoj.damani](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/manoj.damani/32/49452_2.png) [@manoj.damani](https://community.auth0.com/u/manoj.damani)\
**Post date:** [May 29, 2024, 1:06pm UTC](https://community.auth0.com/t/role-based-access-control-in-applications/135203/1 "2024-05-29T13:06:43Z")

</div>

Hi there,

I am looking to implement role based authorizations for users but without using API’s. I am using applications and wanted to know how to implement this.

Regards,

---

<div class="post-metadata">

**Author:** ![aleksander1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/aleksander1/32/49698_2.png) [@aleksander1](https://community.auth0.com/u/aleksander1)\
**Post date:** [May 31, 2024, 2:03pm UTC](https://community.auth0.com/t/role-based-access-control-in-applications/135203/3 "2024-05-31T14:03:15Z")

</div>

Ooph, that’s a tough one. We tried working with Auth0 on this but in the end migrating to Stytch seemed to solve the problem 👍

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 31, 2024, 10:13pm UTC](https://community.auth0.com/t/role-based-access-control-in-applications/135203/4 "2024-05-31T22:13:10Z")

</div>

Hey there @manoj.damani welcome to the community!

Can you help us understand your use case a little better? I’m not entirely sure what you mean by without APIs - You can assign roles to user’s directly in your Auth0 dashboard, include those in user access and/or ID tokens and make decisions in your app based on those.

If this is not what you are referring to, do let us know - The more detailed information you can provide the better!

---

<div class="post-metadata">

**Author:** ![manoj.damani](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/manoj.damani/32/49452_2.png) [@manoj.damani](https://community.auth0.com/u/manoj.damani)\
**Post date:** [June 2, 2024, 5:00am UTC](https://community.auth0.com/t/role-based-access-control-in-applications/135203/5 "2024-06-02T05:00:15Z")

</div>

Hi @ty.frith

Thanks for the welcome 🙂

So the idea is when a user logs in, I should be able to pull a role designated to him. I have created a sample user and can only assign roles in API. As of now, if I login to an application instead of an API, I cannot get the user roles. RBAC can only be activated within API’s.

I am working towards storing the user roles in the app\_metadata and trying to retrieve it when the user logs in. This is complicated because you have to get an access token form the management API and then try to retrieve the user information. I am not still sure whether you login to the Auth0 Account Management API Management Client application or the API.

This is my problem in a nutshell, how to enable roles for the users.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [June 5, 2024, 11:32pm UTC](https://community.auth0.com/t/role-based-access-control-in-applications/135203/6 "2024-06-05T23:32:59Z")

</div>

> [@manoj.damani](#):
>
> I am working towards storing the user roles in the app\_metadata and trying to retrieve it when the user logs in. This is complicated because you have to get an access token form the management API and then try to retrieve the user information. I am not still sure whether you login to the Auth0 Account Management API Management Client application or the API.

Using `app_metadata` is a great way to store roles - You can also assign them directly to users and not assign API permissions to roles, but just _infer_ them. Rather than using the Management API, you can set `app_metadata` as a custom claim in user’s tokens directly. At that point when an access token is passed to your backend (or even using the ID token on front end) you can make decisions you need to based on roles assigned in `app_metadata`. A [post-login action](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow) might look like:

```auto
exports.onExecutePostLogin = async (event, api) => {
  // Define the namespace for your custom claims
  const namespace = 'https://your-app-namespace/';

  // Retrieve app_metadata
  const appMetadata = event.user.app_metadata || {};

  // Add a custom claim from app_metadata
  // Example: Add a custom claim for a role stored in app_metadata
  const role = appMetadata.role || 'guest';

  // Add the custom claim to the ID token
  api.idToken.setCustomClaim(`${namespace}role`, role);

  // Add the custom claim to the access token
  api.accessToken.setCustomClaim(`${namespace}role`, role);
};

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 19, 2024, 11:33pm UTC](https://community.auth0.com/t/role-based-access-control-in-applications/135203/7 "2024-06-19T23:33:05Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.