Scopes and permissions with RBAC for Machine-to-machine authentication

[tommyr]

I have two Applications (an SPA and a Machine to Machine app), and a custom API registered in my Auth0 account. The API has RBAC enabled, and a few permissions configured for it.

When I perform the client_credential OAuth grant using my M2M app, the token that comes back includes two claims (scope and permissions), and both always include all allowed permissions for that application, regardless of what scopes I request. Is this expected?

In contrast, authenticating with the SPA gives me a token with a permissions claim including all allowed permissions, and a scope claim including only requested scopes.

[dan.woda]

Hi @tommyr,

I apologize for the delay.

Permissions and RBAC are user-centric. This is explained better here:

What is the difference between scopes and permissions?

Question: What is the difference between scopes and permissions? Answer: What are scopes? From the OAuth2 spec: The authorization and token endpoints allow the client to specify the scope of the access request using the “scope” request parameter. In turn, the authorization server uses the “scope” response parameter to inform the client of the scope of the access token issued. The value of the scope parameter is expressed as a list of space- delimited, case-sensitive strings. The str…

This would explain the difference in how they are treated in a SPA where a user is requesting an access token and a M2M app where there is no user.

Hope this helps in some way!
Dan