nuxtjs/auth: Using Auth0 Permissions Array as scopeKey

user_13937241 0
Viewed 529

I want to use the Auth0 Permissions you can set to an user as scope Keys for displaying serveral things on my frontend. An example JWT looks like this:

{
  "iss": "https://xxxxx.eu.auth0.com/",
  "sub": "github|xxxxx",
  "aud": [
    "https://xxxxx.app/api/secret",
    "https://xxxx.eu.auth0.com/userinfo"
  ],
  "iat": 1594843242,
  "exp": 1543243234,
  "azp": "lLKv8g6Z43423423421eJjO4n",
  "scope": "openid profile email",
  "permissions": [
    "admin",
    "read:users"
  ]
}

Now I added scopeKey to my auth configuration in my nuxt.config.js

auth: {
    scopeKey: 'permissions',
[...]
}

In my application

this.$auth.hasScope('admin')

is always returning false.

Am I am missing somethings or did I get something wrong? Is it not possible because it is not space separated like the normal "scope"? Thanks in advance!

nuxtjs auth0 javascript
1 Answers

Got it: My wrong thought was that auth is looking in the JWT Token. It isn't it looks in the user info which is got from Auth0 at Login. Here the permissions are not included.

But: You can include api permissions from users as follows: https://community.auth0.com/t/accessing-the-permissions-array-in-the-access-token/27559/10

You only have to take the snipped and create a rule. Also you have to create a Global Config Setting "NAMESPACE" with some value. I took my iss from the jwt. Now the ScopeKeys are stored under:

auth: {
    scopeKey: 'NAMESPACEuser_authorization.permissions',

Take a note that this rule consumes the Management API and can cause a rate limit. Rate Limits can be found here: https://auth0.com/docs/policies/rate-limits

user_139372410
Related