Trouble understanding scopes vs permissions

Luukth · July 6, 2019, 11:38am

I’m having some trouble understanding this sample use case. In short it suggests to add permission in the access token. This way I can manage which, so-called modules in my application, the user can or can’t see.

When combining this sample use case with this Auth0 Express API Samples I run into a bit of a problem. The express API checks for permissions in the scope. Not in the access token permissions.

const checkScopes = jwtAuthz(['read:messages']);

Are permissions meant for the application called ‘Client’ in RFC specifications and not a custom API.
And scopes for asking the user for permission to access a custom API on behalf of the user?

If using scopes is the correct way of handling this. How would I know when a user authenticates if I need to attach Gift Shop Manager scopes or the Newsletter Admin scopes? I could ask for all scopes and let the RBAC policy on the custom API figure it out, but I think that isn’t the correct way of handling the issue.

Right now I’m using passport-auth0 this stores the user profile in the req.user object. Is there a recommended way to also store the scope or permissions inside this object.

Example of permissions in access token:

{
  "iss": "https://*****.eu.auth0.com/",
  "sub": "auth0|5d18d******9809",
  "aud": [
    "https://*******.com/api",
    "https://de*****nd0.eu.auth0.com/userinfo"
  ],
  "iat": 1562398738,
  "exp": 1562485138,
  "azp": "NgZ2T**********Z5xI7Npkj3larb2k0FPr",
  "scope": "openid profile email",
  "permissions": [
    "read:awesome",
    "read:messages",
    "write:messages"
  ]
}

Luukth · July 8, 2019, 6:37pm

Is there a need for more information regarding my question?

Marcos_Castany · July 10, 2019, 10:54am

Hi @Luukth

Sorry for the delay in the response. Let me try to address some of your doubts

The express API checks for permissions in the scope. Not in the access token permissions.

You can specify the customScopeKey option to use the permissions claim instead of the scope.

The goal of having the permissions claim instead of the scope claim to perform authorization is for the cases you just need to know what permissions the user has in a given API and you don’t need to collect consent from the user (usually first party applications).

Is there a recommended way to also store the scope or permissions inside this object.

When defining the auth0 strategy using passport, you can specify a Verify Callback with signature accessToken, refreshToken, extraParams, profile, done) where you should be able to have the permissions and the user profile.

Regards,
Marcos

halseth.torleif · July 25, 2019, 11:37am

You could probably add some information about the customScopeKey in this quick start demo:
https://auth0.com/docs/quickstart/backend/nodejs.

You have to specify customScopeKey here @Marcos_Castany?

github.com

auth0-samples/auth0-express-api-samples/blob/master/01-Authorization-RS256/server.js#L34


    jwksRequestsPerMinute: 5,
    jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`
  }),


  // Validate the audience and the issuer.
  audience: process.env.AUTH0_AUDIENCE,
  issuer: `https://${process.env.AUTH0_DOMAIN}/`,
  algorithms: ['RS256']
});


const checkScopes = jwtAuthz(['read:messages']);


app.get('/api/public', function(req, res) {
  res.json({
    message: 'Hello from a public endpoint! You don\'t need to be authenticated to see this.'
  });
});


app.get('/api/private', checkJwt, function(req, res) {
  res.json({
    message: 'Hello from a private endpoint! You need to be authenticated to see this.'

Thanks for the info!

brotheredward · September 10, 2019, 9:29am

Hi,

I am confused about this a bit too. Permissions is working fine except for my integration tests, my integration tests use a Client with Machine to Machine access to get an access token, i have granted all the required permissions via the scopes but they come back in the scope field rather than the permissions field.

The code in my application checks the permissions field so my integration tests all now fail, should by code union scope and permissions, or does that pose some other security issue.

Alternatively is there a better way to inegration test without having to supply a users username and password that will return permissions instead of scope.

Thanks, Ed