# \#rbac **URL:** https://community.auth0.com/tag/rbac/1292.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Permissions from event.authorization.permissions become empty in custom JWT generated inside Post Login Action](https://community.auth0.com/t/permissions-from-event-authorization-permissions-become-empty-in-custom-jwt-generated-inside-post-login-action/200229)
**Author:** [@usha78633](https://community.auth0.com/u/usha78633)\ **Replies:** 1\ **Last updated:** [May 29, 2026, 8:42pm UTC](https://community.auth0.com/t/permissions-from-event-authorization-permissions-become-empty-in-custom-jwt-generated-inside-post-login-action/200229 "2026-05-29T20:42:24Z")
I am using a Post Login Action in Auth0 to generate a custom PAT JWT using jsonwebtoken.sign(). RBAC is enabled and “Add Permissions in Access Token” is enabled for my API. The Auth0-issued access token correctly conta… --- ## [View only M2M credentials on a per application basis](https://community.auth0.com/t/view-only-m2m-credentials-on-a-per-application-basis/189051)
**Author:** [@HideNSeekMF](https://community.auth0.com/u/HideNSeekMF)\ **Replies:** 1\ **Last updated:** [July 22, 2025, 11:48am UTC](https://community.auth0.com/t/view-only-m2m-credentials-on-a-per-application-basis/189051 "2025-07-22T11:48:45Z")
Feature: View only M2M credentials on a per application basis Description: When creating a user in a tenant, there is the ability to give “Editor - Specific Apps”, but not option for “Viewer - Specific Apps” or, even be… --- ## [B2B SaaS Identity Challenges: Granular Access Control](https://community.auth0.com/t/b2b-saas-identity-challenges-granular-access-control/188224)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [June 20, 2025, 4:19pm UTC](https://community.auth0.com/t/b2b-saas-identity-challenges-granular-access-control/188224 "2025-06-20T16:19:53Z")
Let’s continue to delve into the issues of Identity support in implementing B2B SaaS applications by exploring access control in this second article of the “B2B SaaS Identity Challenges” series. --- ## [How To Evaluate Resource-Specific Permissions Efficiently with ReBAC instead of RBAC](https://community.auth0.com/t/how-to-evaluate-resource-specific-permissions-efficiently-with-rebac-instead-of-rbac/170130)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [January 24, 2025, 7:19pm UTC](https://community.auth0.com/t/how-to-evaluate-resource-specific-permissions-efficiently-with-rebac-instead-of-rbac/170130 "2025-01-24T19:19:40Z")
Learn how the ReBAC authorization model overcomes RBAC when it comes to evaluate permissions on a specific resource. Read more… :writing\_hand:t2: Brought to you by @tylernix --- ## [Leverage RBAC permissions in a regular Web Asp.Net Core Application](https://community.auth0.com/t/leverage-rbac-permissions-in-a-regular-web-asp-net-core-application/46727)
**Author:** [@samuel.pecoul](https://community.auth0.com/u/samuel.pecoul)\ **Replies:** 2\ **Last updated:** [October 6, 2023, 12:23am UTC](https://community.auth0.com/t/leverage-rbac-permissions-in-a-regular-web-asp-net-core-application/46727 "2023-10-06T00:23:40Z")
Hello ! My company want to switch from an old “home made” authentication/authorization system to Auth0 for all of their applications (mainly regular AspNet Core App). This ‘legacy’ authorization system is based on ‘per… --- ## [How to incorporate roles in the useUser hook from nextjs-auth0?](https://community.auth0.com/t/how-to-incorporate-roles-in-the-useuser-hook-from-nextjs-auth0/92361)
**Author:** [@faabiopk](https://community.auth0.com/u/faabiopk)\ **Replies:** 3\ **Last updated:** [October 14, 2022, 5:09pm UTC](https://community.auth0.com/t/how-to-incorporate-roles-in-the-useuser-hook-from-nextjs-auth0/92361 "2022-10-14T17:09:53Z")
Please include the following information in your post: Which SDK this is regarding: nextjs-auth0 SDK Version: 1.9.1 Platform Version: N/A Code Snippets/Error Messages/Supporting Details/Screenshots: Hi, I am stru… --- ## [Automatically assign roles to federated OIDC users](https://community.auth0.com/t/automatically-assign-roles-to-federated-oidc-users/88217)
**Author:** [@k01157](https://community.auth0.com/u/k01157)\ **Replies:** 4\ **Last updated:** [August 6, 2022, 5:07pm UTC](https://community.auth0.com/t/automatically-assign-roles-to-federated-oidc-users/88217 "2022-08-06T17:07:58Z")
Hi, I use an OpenID Connect enterprise connection to federate users. The returned ID-token contains a custom claim that represents the roles of the given user. I want to dynamically map the content of this id-token claim… --- ## [Role assignment with resource filters](https://community.auth0.com/t/role-assignment-with-resource-filters/51288)
**Author:** [@sanjeevchopra](https://community.auth0.com/u/sanjeevchopra)\ **Replies:** 6\ **Last updated:** [July 29, 2022, 11:58am UTC](https://community.auth0.com/t/role-assignment-with-resource-filters/51288 "2022-07-29T11:58:17Z")
Hello, I have seen Kim Maida’s posts on RBAC and Authorization extension. Wanted to know if Auth0 is considering the use case of resource filtering. Specifically, let’s say a group of users has role Device Operator, … --- ## [NestJS + Graphql + Authorization RBAC: How can I manage roles, groups and permissions(create/read/etc) in backend?](https://community.auth0.com/t/nestjs-graphql-authorization-rbac-how-can-i-manage-roles-groups-and-permissions-create-read-etc-in-backend/81550)
**Author:** [@ValchanOficial](https://community.auth0.com/u/ValchanOficial)\ **Replies:** 12\ **Last updated:** [April 13, 2022, 6:19pm UTC](https://community.auth0.com/t/nestjs-graphql-authorization-rbac-how-can-i-manage-roles-groups-and-permissions-create-read-etc-in-backend/81550 "2022-04-13T18:19:25Z")
How can I manage roles, groups and permissions(create/read/etc) in backend? without needed to access in website. Thank you. --- ## [Authorization Series — Pt 2: Securing HTTP APIs with RBAC rules](https://community.auth0.com/t/authorization-series-pt-2-securing-http-apis-with-rbac-rules/29128)
**Author:** [@ramiro](https://community.auth0.com/u/ramiro)\ **Replies:** 9\ **Last updated:** [September 7, 2020, 11:15am UTC](https://community.auth0.com/t/authorization-series-pt-2-securing-http-apis-with-rbac-rules/29128 "2020-09-07T11:15:49Z")
In this article, you will learn how you can leverage Auth0’s RBAC (Role-Based Access Control) feature to handle end-user authorization in your APIs. Read on :raising\_hands: Brought to you by @bruno.krebs :man\_technolog… --- ## [How to "Protect a route based on specific claims" for "Standard Web Application" (NodeJS/Express) and](https://community.auth0.com/t/how-to-protect-a-route-based-on-specific-claims-for-standard-web-application-nodejs-express-and/75582)
**Author:** [@uscheidegger](https://community.auth0.com/u/uscheidegger)\ **Replies:** 3\ **Last updated:** [March 2, 2022, 3:11pm UTC](https://community.auth0.com/t/how-to-protect-a-route-based-on-specific-claims-for-standard-web-application-nodejs-express-and/75582 "2022-03-02T15:11:32Z")
Hi there I’m following the Express Quickstart and the Auth0 Express Pug tutorial to protect a standard web application. Login / logout works fine. But now, I need to protect the application further, so that only users … --- ## [Auth0+Django Setting Roles and Permissions](https://community.auth0.com/t/auth0-django-setting-roles-and-permissions/78702)
**Author:** [@ovezovv](https://community.auth0.com/u/ovezovv)\ **Replies:** 3\ **Last updated:** [March 2, 2022, 1:25am UTC](https://community.auth0.com/t/auth0-django-setting-roles-and-permissions/78702 "2022-03-02T01:25:49Z")
When I implement Auth0 Authentication and “Set Roles to User” Rule function (user, context, callback) { const namespace = 'https://dev-o0hx8kbg.us.auth0.com'; const assignedRoles = (context.authorization || {}).role… --- ## [Support for User Groups in RBAC](https://community.auth0.com/t/support-for-user-groups-in-rbac/75553)
**Author:** [@joez](https://community.auth0.com/u/joez)\ **Replies:** 1\ **Last updated:** [December 30, 2021, 8:57pm UTC](https://community.auth0.com/t/support-for-user-groups-in-rbac/75553 "2021-12-30T20:57:13Z")
Hello, In our implementation of RBAC, we have a need to create (and delete ) user Groups with the API and arbitrarily assign/unassign Users to those Groups. We also want to be able to assign scopes to these Groups to co… --- ## [Assigning roles for first login accross two rules](https://community.auth0.com/t/assigning-roles-for-first-login-accross-two-rules/45214)
**Author:** [@luuk.de.ville](https://community.auth0.com/u/luuk.de.ville)\ **Replies:** 10\ **Last updated:** [December 6, 2021, 8:15pm UTC](https://community.auth0.com/t/assigning-roles-for-first-login-accross-two-rules/45214 "2021-12-06T20:15:28Z")
Hi, we have a rule in order to assign roles for a user that logs in for the first time. In a second rule we add these roles to the token. First rule for first login, based upon implementation Assign Roles to users usin… --- ## [Where in the pipeline is Core RBAC performed?](https://community.auth0.com/t/where-in-the-pipeline-is-core-rbac-performed/74084)
**Author:** [@bschreiber](https://community.auth0.com/u/bschreiber)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 12:26am UTC](https://community.auth0.com/t/where-in-the-pipeline-is-core-rbac-performed/74084 "2021-12-02T00:26:36Z")
It’s not clear from the documentation when Core RBAC is applied - is it before Rules, or after Rules? Which Action triggers fire before RBAC is applied to the requested scopes? And the real point I’m getting at is: will… --- ## [Assigning roles not working on first login](https://community.auth0.com/t/assigning-roles-not-working-on-first-login/74080)
**Author:** [@itstawmu](https://community.auth0.com/u/itstawmu)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 11:25pm UTC](https://community.auth0.com/t/assigning-roles-not-working-on-first-login/74080 "2021-12-01T23:25:51Z")
Hey, As part of our Auth0 deployment we are assigning roles to users on first login which is working great using Rules and the Management API. The problem I’m facing right now is that the new roles don’t take effect unt… --- ## [Regular Web App with RBAC](https://community.auth0.com/t/regular-web-app-with-rbac/43966)
**Author:** [@ryosuke.yamazaki](https://community.auth0.com/u/ryosuke.yamazaki)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 5:57pm UTC](https://community.auth0.com/t/regular-web-app-with-rbac/43966 "2021-10-19T17:57:37Z")
Hi All, I am developing a Regular Web App with RBAC feature using Ruby on Rails and Auth0. As far as I see there are no examples for building RBAC feature with such regular web app. Are there good document or example fo… --- ## [Signup and Login email whitelist with minimal effort](https://community.auth0.com/t/signup-and-login-email-whitelist-with-minimal-effort/66541)
**Author:** [@subtlestag](https://community.auth0.com/u/subtlestag)\ **Replies:** 6\ **Last updated:** [July 22, 2021, 5:00pm UTC](https://community.auth0.com/t/signup-and-login-email-whitelist-with-minimal-effort/66541 "2021-07-22T17:00:28Z")
Hi, I have a web application for which I would like to enable users to Signup to and Login to. I would only like specific users to be able to signup, and I would only like the users which have signed up to be able to l… --- ## [Multiple Applications' Roles visible in tokens](https://community.auth0.com/t/multiple-applications-roles-visible-in-tokens/64760)
**Author:** [@bdellegrazie](https://community.auth0.com/u/bdellegrazie)\ **Replies:** 11\ **Last updated:** [June 24, 2021, 2:49pm UTC](https://community.auth0.com/t/multiple-applications-roles-visible-in-tokens/64760 "2021-06-24T14:49:12Z")
We’re trying to implement Application Specific Roles and only have the roles associated with the application being signed into visible in the corresponding token(s). We’re using the RBAC extension with the published rul… --- ## [How to create a RBAC rule based on user roles](https://community.auth0.com/t/how-to-create-a-rbac-rule-based-on-user-roles/64514)
**Author:** [@karthick.vankayala](https://community.auth0.com/u/karthick.vankayala)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 1:10pm UTC](https://community.auth0.com/t/how-to-create-a-rbac-rule-based-on-user-roles/64514 "2021-06-15T13:10:38Z")
How to create a rule that is based on user’s role where the role is created within Auth0. This role assignment is not adding up to users metadata. --- ## [Authorization Core - Number of Roles](https://community.auth0.com/t/authorization-core-number-of-roles/31197)
**Author:** [@mikahb](https://community.auth0.com/u/mikahb)\ **Replies:** 7\ **Last updated:** [March 18, 2021, 5:20pm UTC](https://community.auth0.com/t/authorization-core-number-of-roles/31197 "2021-03-18T17:20:29Z")
Our application is multi-tenant which has proven to be a bit of a challenge with Auth0. I think we’ve got it working now using the new Authorization Core RBAC stuff which is great, but the way we implemented roles makes… --- ## [How do I add a default role & permissions to a user?](https://community.auth0.com/t/how-do-i-add-a-default-role-permissions-to-a-user/43269)
**Author:** [@maennchen](https://community.auth0.com/u/maennchen)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 5:23pm UTC](https://community.auth0.com/t/how-do-i-add-a-default-role-permissions-to-a-user/43269 "2021-01-19T17:23:17Z")
Continuing the discussion from How do I add a default role to a new user on first login?: Following this discussion, I implemented the rule to add the default role. This will however only add the granted permissions wh… --- ## [Retrieve newly added user scope without user re-authorize](https://community.auth0.com/t/retrieve-newly-added-user-scope-without-user-re-authorize/50174)
**Author:** [@flegald](https://community.auth0.com/u/flegald)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 8:20am UTC](https://community.auth0.com/t/retrieve-newly-added-user-scope-without-user-re-authorize/50174 "2020-09-22T08:20:02Z")
Hello Auth0 Forums I have an instance where a user is given a new role after they are authorized in the SPA. My goal is to update the JWT token cached inside the application without having the user logout and log back … --- ## [How to use RBAC with an Application (rather than an API)?](https://community.auth0.com/t/how-to-use-rbac-with-an-application-rather-than-an-api/45301)
**Author:** [@dean.dashwood](https://community.auth0.com/u/dean.dashwood)\ **Replies:** 3\ **Last updated:** [June 27, 2020, 1:30am UTC](https://community.auth0.com/t/how-to-use-rbac-with-an-application-rather-than-an-api/45301 "2020-06-27T01:30:13Z")
I’m creating an ASP.Net MVC application. As such, I have configured an Application in the Auth0 dashboard (not an API). I’ve created some roles, and added users to those roles. When configuring an API, there is an opti… --- ## [Can RBAC roles be assigned automatically on register? plans to support advanced RBAC features?](https://community.auth0.com/t/can-rbac-roles-be-assigned-automatically-on-register-plans-to-support-advanced-rbac-features/37303)
**Author:** [@xenoterracide](https://community.auth0.com/u/xenoterracide)\ **Replies:** 2\ **Last updated:** [February 4, 2020, 12:26pm UTC](https://community.auth0.com/t/can-rbac-roles-be-assigned-automatically-on-register-plans-to-support-advanced-rbac-features/37303 "2020-02-04T12:26:36Z")
Can RBAC roles be assigned automatically on register? any plans to support hierarchical roles? or other features of RBAC like SSD and DSD contstraints? currently RBAC seems like simply DAC groups. can RBAC be configured …