Roles for Suborganizations

[mathias.mahlknecht]

Hi,

we are currently evaluating Auth0 for our use cases.

We have multiple clients that use our application, which we can easily hold in Auth0 as organizations.
But additionally, we need to divide these organizations further into suborganizations, these suborganizations again can consist of suborganisations, and so on.

User can be members of all or of some suborganizations and have different roles for different suborganizations.

As I can see, it Auth0 currently does not support suborganizations.
It might be possible to hold the information about the suborganizations in our domain and check it with a login action or rule.
But for this it has to be possible:

• to trigger a token refresh if the user changes suborganization
• to add a role to the token only, but not to the user

Is this possible? Or are there other ways we could achieve our use cases?

[tyf]

Hi there @mathias.mahlknecht welcome to the community!

@mathias.mahlknecht

As I can see, it Auth0 currently does not support suborganizations.

That’s correct, Auth0 does not currently support sub-organizations. Typically, what I have seen implemented is a tenant per customer + Organizations or simply an Organization per what would be “nested” Organization where each of these has their own database assigned.

The following thread has some good information regarding a user switching Organizations:

User switch between Organization

Answering some questions that I posed after some digging around for an implentation. Using the React-sdk, we can use the getAccessTokenSilently from the auth0 hook and pass in organization (similar to the same prop on the Auth0Provider) with the new org_id when a user wants to switch organization. To do this, we have to pass in the ignoreCache flag when we get the access token (otherwise you’d get the same access token for the same organization. Drawback is obvious, if a user switches back an…

Here is an FAQ regarding adding roles to tokens:

How to add Roles and Permissions to the ID Token using Actions?

Problem statement Is it possible to retrieve the user’s Roles and/or Permissions and include them in the JWT Token? Solution Yes, it’s possible to retrieve the user’s Roles and/or Permissions and append them to either the ID Token or Access Token. To do so, you must use a Post-Login Action script. 1.1 Roles When adding the user’s Roles to the token, call the event.authorization.roles property and add it as a custom claim to the Token. Please see here on creating namespaced custom claims. Be…

Regarding:

@mathias.mahlknecht

to add a role to the token only, but not to the user

Are you able to elaborate on what you mean here? No roles will exist at /api/v2/users/{id} but rather /api/v2/users/{id}/roles for top level roles and /api/v2/organizations/{id}/members/{user_id}/roles for Organization specific roles.

I did also find an existing Feedback request for sub-organizations:

Hirearchial Organizations

Feature: I would like to have hierarchical organizations structure Description: I would like the ability to create a hirearchial brand structure similar to what is described here (How do I handle "organizations" in a hirearchy) Use-case: It would allow finer grain control over access.

Hope this helps!

[mathias.mahlknecht]

Thanks, this was very helpful.

[tyf]

No problem, happy to help!