Auth0 Roles

[BenMenegazzo]

I have spent some time today attempting to integrate DAB with the identity provider Auth0. Basic authorization as "authenticated" seems to work without issue. However, Auth0 access tokens do not expose a "roles" claim. The equivalent seems to be a "permissions" claim. Is there way to map "roles" to a claim with a different title?

[seantleonard]

Thanks for reaching out, @BenMenegazzo. You're right that it Auth0 seems to not support emitting roles in a roles claim. All their forum post responses direct to the fact that roles is a restricted claim in Auth0 (even though it seems they don't populate it) https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims#general-restrictions

I created #2395 to track adding a capability in DAB to modify which token claim DAB uses to look for "roles" because DAB currently explicitly looks for the roles claim.