Auth0-规则和组&&用户管理

Question

I have created an account with Auth0 and I am trying to get a simple login for Angular 2 to our backend API.

1. What I am trying to do is to be able to access the roles in the API to see whether the user has the correct permissions.

I have enabled the Auth0 Authorization extension I have gone in and created one group and one role, I have assigned these to a test user which I have created, I have then gone to the configuration and published the rules for token contents and persistence.

How can I view the permissions/groups from the JWT in an nodejs app? I am using express-jwt and this:

const authenticate = jwt({
  secret: config.get('AUTH0_CLIENT_SECRET'),
  audience: config.get('AUTH0_CLIENT_ID'),
  credentialsRequired: false,
});

Which is giving me details such as iss, sub, aud. But no details on the user metadata, how am I able to retrieve this? Also as I have clearly not used Auth0 before, is it best practice to store the user details on our own databases also so I can use my own ID to store against the user actions, or is it possible to use an ID if Auth0 give one to store against user actions in our database.

EDIT 1

Ok I can see there is an options parameter for the Lock which you can pass scopes in, is it bad practice to request these when logging in? There will only really be a handful of groups/roles for now. Or is better that the API can lookup the user using the token provided to get the app_metadata to view the permissions etc, if so how can I look this up?

---

2. How am I able to manage the users and view them so I can display them in our own admin panel and manage the permissions they have.

Answer 1

For the case where the groups and roles information are available within the token itself (as groups and roles claims) and given that you're using express-jwt then you can access this information on the server-side by accessing:

req.user.groups
req.user.roles

In essence, express-jwt will make the claims contained within the token available in the req.user object.

In relation to the ID you use to identify the user you can use the value contained within the sub claim of the user token. This value is guaranteed to be unique and stable so a recurring user that uses authenticates in exactly the same way will always have the same value within the sub claim.

You already discovered that one way to include the groups and roles information is to request it through the scope parameter. It's not a bad practice to request this information to be included in the token, however, you need to take in consideration that tokens delivered through the implicit grant which is used by SPA are included as a part of the callback URL and as such their maximum size is constrained by the limits imposed on URL's.

---

In regards to your second question, you could implement your own management backend by integrating both the Auth0 Authorization extension API and also the Auth0 Management API; see the following links for more info:

• https://auth0.com/docs/extensions/authorization-extension#enabling-api-access
• https://auth0.com/docs/api/management/v2