No longer able to generate id token with app_metadata about auth0.swift HOT 6 CLOSED

If you had looked at the Example: Add Custom Claims > Sample Rule:

You can modify this to add the app_metadata value to the id_token, for example if you have a roles property it can be returned as a custom claim by adding a rule as follow:

function (user, context, callback) {
  
  if (context.idToken) {
    // You could use app_metadata or any other source for permission data
    // IMPORTANT: The claim name needs to use an HTTP-based namespace
    context.idToken["https://example.com/roles"] = user.app_metadata.roles; 
  }
  
  callback(null, user, context);
}

Once you decode the id_token JWT it will be presented as a custom claim:

...
"https://example.com/roles": [
    "admin"
  ]

from auth0.swift.

For future Google users that find this thread - I was able to solve this based on @cocojoe 's suggestion to use a rule.

Here's my rule:

function (user, context, callback) {
  var app_metadata = user.app_metadata || { };
  var key = "https://mydomain.com/app_metadata";
  if (context.accessToken) {
    context.accessToken[key] = app_metadata;
  }
  if (context.idToken) {  
    context.idToken[key] = app_metadata;
  }
  callback(null, user, context);
}

Where you need to replace mydomain.com with your actual domain name.

Thanks again, @cocojoe

from auth0.swift.

Please have a look at https://auth0.com/docs/scopes/current Thx

from auth0.swift.

@cocojoe

RTFM isn't helpful.

This document doesn't mention app_metadata anywhere, but rather, only gives examples of other claims.

I suspect one of the following is true:

(1) This is a regression. It's possible to simply include app_metadata in the scope for the legacy call, and it gets correctly added to the id_token.

(2) This is possible to do (I hope), but it's poorly documented, as it's not mentioned in the documentation.

from auth0.swift.

@JRG-Developer this is not an issue of the library since its doing whats intended for the method since the new grant only allows the scopes either from OpenID connect or from your API identified by the audience parameter.

Also @cocojoe was right with RTFM since in that document https://auth0.com/docs/scopes/current#custom-claims you can find how you should be adding metadata to the id_token via a rule since thats is how it should be one using the new method.

from auth0.swift.

@cocojoe

Thank you for the code example. I'll give this a go.

from auth0.swift.