如何让Auth0的用户管理中的角色添加到JWT中？

Question

我有一个 Auth0 应用程序，我正在通过用户管理维护角色。我希望将分配给用户的那些角色添加到 JWT returned.

我在 openid_connect_configuration.conf

中确实有以下内容

map $host $oidc_scopes {
    default "openid+profile+email+offline_access+openid roles";
}

我在 /.well-known/openid-configuration

中有以下内容

{
    ...
    "scopes_supported": [
        "openid",
        "profile",
        "offline_access",
        "name",
        "given_name",
        "family_name",
        "nickname",
        "email",
        "email_verified",
        "picture",
        "created_at",
        "identities",
        "phone",
        "address"
    ],
    "response_types_supported": [
        "code",
        "token",
        "id_token",
        "code token",
        "code id_token",
        "token id_token",
        "code token id_token"
    ],
    "code_challenge_methods_supported": [
        "S256",
        "plain"
    ],
    "response_modes_supported": [
        "query",
        "fragment",
        "form_post"
    ],
    "subject_types_supported": ["public"],
    "id_token_signing_alg_values_supported": [
        "HS256",
        "RS256"
    ],
    "token_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post"
    ],
    "claims_supported": [
        "aud",
        "auth_time",
        "created_at",
        "email",
        "email_verified",
        "exp",
        "family_name",
        "given_name",
        "iat",
        "identities",
        "iss",
        "name",
        "nickname",
        "phone_number",
        "picture",
        "sub"
    ],
    "request_uri_parameter_supported": false
}

如何将 Auth0 中的内容设置为 return 分配给登录用户的角色？我试过查看文档，但没有成功。

Answer 1

我通过探索 Auth0 中的扩展找到了答案。我安装了 Auth0 Authorization 扩展。我启用了组和角色。

然后我添加了以下规则：

function setRolesToUser(user, context, callback) {
  // Roles should only be set to verified users.
  if (!user.email || !user.email_verified) {
    return callback(null, user, context);
  }

  user.app_metadata = user.app_metadata || {};

  auth0.users
    .updateAppMetadata(user.user_id, user.app_metadata)
    .then(function () {
      context.idToken['https://example.com/auth'] = user.app_metadata.authorization;
      callback(null, user, context);
    })
    .catch(function (err) {
      callback(err);
    });
}

我得到以下 JWT 负载：

{
    "https://example.com/auth": {
        "groups": ["Samples"],
        "roles": ["Editor"]
    },
    "sub": "auth0|xxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "nickname": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "email_verified": true,
    "iss": "https://dev-xxxxxxxxxx.us.auth0.com/",
    "updated_at": "2022-04-29T20:01:14.585Z",
    "iat": 1.651330616E9,
    "picture": "https://s.gravatar.com/avatar/a705adb3d5d8530c35c41a9de260cd3c?s=480&r=pg&d=https%3A%2F%2Fcdn.auth0.com%2Favatars%2Flo.png",
    "exp": 1.651366616E9,
    "name": "xxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx",
    "aud": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "nonce": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "email": "xxxxx.xxxxxxxxx@example.com"
}

如何让Auth0的用户管理中的角色添加到JWT中？

How to get the roles in Auth0's user management to be added in the JWT?

jwt

openid-connect

auth0