Styjun

I'm working at a project using Auth0. We wish to use the permission system in the Authorization Extension to set it up.

E.g.
Role Admin:
users:viewAll
users:edit
users:xyz

Role User:
users:editOwn
users:viewOwn
users:ect

And then in the Project if possible use the [Authorize(Policy = "users:kvm")] tag.

How-ever, I cannot find any resources on how to actually use the Authorization Extension from Auth0. I'm at a complete loss, so if anyone could guide me on where to even look for these, I'd be very happy.

The authorization extension is accessible via API

You have to enable the API access and set up a machine to machine communication so that you can hit the endpoints. (like described in the link)

Then use this documentation to manage permissions, roles, groups etc.

Each request has to include a token (JWT) which you have to get beforehand from https://yourdomain.auth0.com/oauth/token via a POST request.

You have to provide four parameters:

grant_type = client_credentials 
client_id = from your auth0 application
client_secret = from your auth0 application
audience=urn:auth0-authz-api

Put the token into the header of each request as "Authorization" : "Bearer #YOURTOKEN#"

You can use any REST client to hit the endpoints. For the start I'd recommend Postman to test the endpoints and check which calls you need. There is a handy collection you can use with some adjustments.

you can use the Authorization Extension to create a permission that represents access to each application.

Note: While creating permission “Name” should reflect the client id of the application

Example image below

Then create role that represent each application and make sure the relevant permission is selected.

In this example: The role name is” SampleClientAccess”

3. Then create the group and link the role that you have created. Add relevant users to the group

4. final step. Go to Dashboard > Rules > create custom rule and the following code.

function (user, context, callback) 
 // Assume that permission for an application is the client_id of the permission then
 
 if (user.permissions.indexOf(context.clientID) === -1 )
 callback(new UnauthorizedError('You are not allowed to access ' + context.clientName + JSON.stringify(user)));
 
 callback(null, user, context);

Hope this will help you in some way.

I have decided to drop auth0's Authorization and work out a system myself.

Can't wrap my head around the documentation.

I want to add how I'm using it in both legacy .NET MVC applications and .NET Core 2.0 APIs as I hope it'll save someone a lot of time that I've spent trying to figure this out.

If what you want is just to get the groups, permissions, roles and update user accounts in auth0 then follow the steps in the answer by @StV.

But if you want to check permissions/roles etc in .NET then this is how I've done it:

Add the groups, roles and permissions to either the access or Id token (or both). To do this follow the instructions here

Once you publish the rules from the above config step you have to create another rule yourself in Auth0 to copy the info in to the tokens (this got me for a while). this has to run after the rule published/created by Auth0. Mine looks like this:

function (user, context, callback) 
 if(user.app_metadata) 
 var namespace = 'https://visionplatform.com/';
 context.accessToken[namespace + 'roles'] = user.roles;
 context.accessToken[namespace + 'permissions'] = user.permissions;
 context.idToken[namespace + 'roles'] = user.roles;
 context.idToken[namespace + 'permissions'] = user.permissions; 
 
 callback(null, user, context);

Now if you the user logs in they will have their groups, roles and permissions in their tokens. However keep in mind that ONLY the groups, roles and permissions for the specific client you authenticated against will show (I lost hours to this).

So now you can get/check the permissions in code be decoding the JWT. Here's a few snippets of code how I've done this in a library method (i.e. not an authorize attribute):

First get your TokenValidationPrams

public TokenValidationParameters GetTokenValidationParameter(string domain, string audience)

 IConfigurationManager<OpenIdConnectConfiguration> configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>($"domain.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
 var openIdConfig = AsyncHelper.RunSync(async () => await configurationManager.GetConfigurationAsync(CancellationToken.None));

 return new TokenValidationParameters
 
 ValidIssuer = $"domain",
 ValidAudiences = new[] audience ,
 IssuerSigningKeys = openIdConfig.SigningKeys
 ;

Then decode your JWT to get the claims

private ClaimsPrincipal GetValidatedToken(string token, TokenValidationParameters validationParameters)

 var handler = new JwtSecurityTokenHandler();
 return handler.ValidateToken(token, validationParameters, out var _);

Now you can check that claims principle to see if it includes your group, permission or whatever (please note I just check the permission).

public bool ValidateTokenClaimsPermissionExists(string token, string domain, string audience, string permission)

 var claimsPrincipal = GetValidatedToken(token, _tokenValidationParameters);

 var scopePermission = claimsPrincipal.FindFirst(c => c.Type == Constants.PermissionsClaimTypeName && c.Value == permission);
 return scopePermission != null;

I use the above to make separate calls to check permissions but you could (and probably should) write your own authorize attribute or if you're using .NET Core you can write an AuthorizationHandler middleware to check whatever claims you want as per the documentation here. The one below checks the scopes but you could adapt it to check the permissions as per the above code:

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HasScopeRequirement requirement)

 // If user does not have the scope claim, get out of here
 if (!context.User.HasClaim(c => c.Type == "scope" && c.Issuer == requirement.Issuer))
 
 return Task.CompletedTask;
 

 // Split the scopes string into an array
 var scopes = context.User.FindFirst(c => c.Type == "scope" && c.Issuer == requirement.Issuer).Value.Split(' ');

 // Succeed if the scope array contains the required scope
 if (scopes.Any(s => s == requirement.Scope))
 context.Succeed(requirement);

 return Task.CompletedTask;

I'm going to use bits from all of the above to write an authorize attribute for my .NET MVC applications too.

For a simple setup you can set the roles through the Auth0 GUI and use a rule to apply that to the user:

function (user, context, callback) 

 // Roles should only be set to verified users.
 if (!user.email 

Your startup.cs should have something like this:

services.AddAuthorization(options =>

 options.AddPolicy("Administrator", authBuilder => authBuilder.RequireRole("Administrator"); );
 options.AddPolicy("User", authBuilder => authBuilder.RequireRole("Administrator", "User"); );

And in the Controller for example:

[Authorize(Roles = "Administrator, User")]
<<your code>>