andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn how to add Role-Based Access Control (RBAC) to your B2B SaaS application that leverages Auth0 Organizations.

In the realm of B2B SaaS, the ability to offer isolated and tailored experiences to distinct customer organizations is paramount. Auth0 Organizations provides a robust framework for managing these multi-tenant environments, offering features like dedicated user bases, custom branding, and organization-specific configurations. Building upon this foundation, implementing Role-Based Access Control (RBAC) within Auth0 Organizations unlocks a new level of granularity in managing user permissions.

In this article, we will explore how roles fit in the Auth0 Organizations framework and how to manage them programmatically using the SaaS Blazor application we are building throughout a series of articles.

## Understanding Role Management in Auth0 Organizations

Auth0 allows you to define roles and permissions to apply the [Role-Based Access Control authorization model](https://auth0.com/docs/manage-users/access-control/rbac). Usually, roles assigned to users apply across your entire Auth0 tenant. For example, a user who is assigned the _editor_ role will keep this role in all applications registered in your Auth0 tenant unless you apply a different authorization policy via [Actions](https://auth0.com/docs/customize/actions).

Auth0 Organizations allow you to represent your customers' users as distinct entities within your Auth0 tenant. This isolation is crucial for managing users, connections, and policies on a per-organization basis. In the Auth0 Organization context, roles are defined and scoped *within* a specific Organization. This crucial distinction allows for fine-grained control over what members can do *within* their designated Organization.

Consider a scenario where you have two customers using your SaaS application: Acme Inc. and Foo Corp. You used Auth0 Organizations to separate Acme Inc. users from Foo Corp. users. However, based on the [login flow you configured for your application](https://auth0.com/docs/manage-users/organizations/login-flows-for-organizations) and the [connection model](https://auth0.com/docs/manage-users/organizations/organizations-overview#connection-model) you are applying, you can have specific situations.

For example, suppose you have enabled users to log in as both an individual and an organization user. In that case, the question arises as to which role to consider. In fact, the user can be the application administrator when logging in as an individual, but a mere member when logging in as an Acme Inc. user.

Similarly, if you allow users to be shared between organizations, i.e., a user can be both an Acme Inc. and a Foo Corp. user, then there may be a need for the user to have different roles based on the Organization they are logging in to. For example, the user can be an administrator when logging in to Acme Inc. and just a member when logging in to Foo Corp.

Hence, the need for having roles linked to the Organization.

> In this article, we discuss traditional Role-Based Access Control, but in more complex B2B SaaS scenarios, you may need more granularity for your authorization check. In this case, you can leverage [Fine-Grained Authorization](https://a0.to/auth0-fga-content).

## Creating Roles for an Auth0 Organization

Creating roles to assign to users in an Auth0 Organization is straightforward. You can use your Auth0 dashboard or the Auth0 Management API. In both cases, there are two basic steps:

1. Create [the roles your application needs in your tenant](https://auth0.com/docs/manage-users/access-control/configure-core-rbac/roles/create-roles).
2. Assign one or more [roles to the members of an Organization](https://auth0.com/docs/manage-users/organizations/configure-organizations/add-member-roles).

In this article, we will use the Auth0 Management API to create roles and assign them to the members of an Organization.

### The Sample Application

The scenario you will be using is the B2B SaaS application we built in the previous articles using Blazor. The following articles recap how we built the application:

- [Add Auth0 Organizations to Your B2B Blazor Web App](https://auth0.com/blog/auth0-organizations-for-b2b-saas-blazor-web-apps/)
- [Enable Self-Subscribing Model in Your Blazor B2B SaaS Application](https://auth0.com/blog/enable-self-subscription-in-blazor-b2b-saas-application/)
- [Enforce Customer Email Verification in Your B2B Blazor Web App](https://auth0.com/blog/enforce-customer-email-verification-b2b-saas-blazor-app/)

You can download the starting Blazor project by running the following command:

```bash
git clone --branch email-verification --single-branch https://github.com/andychiare/MyBlazorSaaS
```

Follow the instructions in the attached README file to register and configure the application with Auth0. If you don't have an Auth0 account, [you can sign up for free](https://a0.to/blog_signup).

The Blazor application allows a new customer to subscribe and create a new Organization, but currently it makes no distinction between users. We want to introduce two roles in the application:

- the *admin* role, which is automatically assigned to the user who subscribes to your application and allows them to access an admin dashboard.
- the *member* role, which can be assigned to users who can't access the admin dashboard.

> In this example, you do not use permissions, which are typically assigned to roles. To keep things simple, you are focusing on role names to make access control.

<include src="Auth0TemplatesForDotnetCTA" />

### Creating the roles for the Auth0 Organization

Before modifying the application code, make sure you to update the permissions your application needs for managing roles. Assuming you have configured your application accordingly to the mentioned README file, go to your [Auth0 dashboard](https://manage.auth0.com/) and locate the *ManagementClient* application in the [Applications > Applications](https://manage.auth0.com/#/applications) section.

Select the *APIs* tab of the application's configuration page and expand the area below the Auth0 Management API item. Then, select the following permissions to add them to the existing ones:

`read:roles`, `create:roles`,  `update:organizations`, `create:organization_member_roles` , and `read:organization_member_roles`.

Finally, click the *Update* button to apply your changes.

Now you can proceed to make the changes that allow the application to create the *admin* and *member* roles if they have not been created previously. The *admin* role will be assigned to the newly created user within the new Organization.

For this purpose, open the `CreateOrganization.razor` file in the `MyBlazorSaaS/Components/Pages/Onboarding` folder and apply the changes highlighted below:

```csharp


//...existing code..
  
  private async Task StartCreateOrganization()
  {
    if (!String.IsNullOrEmpty(OrganizationName))
    {
      Organization organization;

      try {
        //...existing code...

        // 👇 new code
        //Create admin role if it does not exist
        Role adminRole;
        var adminRoleList = await managementClient.Roles.GetAllAsync(
          new GetRolesRequest {NameFilter = "admin"}
          );

        if (adminRoleList.Count == 0)
        {
          adminRole = await managementClient.Roles.CreateAsync(
            new RoleCreateRequest
            {
              Name = "admin",
              Description = "Manage the organization's configuration."
            }
          );
        } else {
          adminRole = adminRoleList[0];
        }

        //Create member role if it does not exist
        Role memberRole;
        var memberRoleList = await managementClient.Roles.GetAllAsync(
          new GetRolesRequest {NameFilter = "member"}
          );

        if (memberRoleList.Count == 0)
        {
          memberRole = await managementClient.Roles.CreateAsync(
            new RoleCreateRequest
            {
              Name = "member",
              Description = "Member of an organization."
            }
          );
        } else {
          memberRole = memberRoleList[0];
        }
        // 👆 new code

        //Add member
        await managementClient.Organizations.AddMembersAsync(
          organization.Id,
          new OrganizationAddMembersRequest() {
            Members = [UserId]
          }
        );

        // 👇 new code
        //Assign admin role to the new member
        await managementClient.Organizations.AddMemberRolesAsync(
          organization.Id,
          UserId,
          new OrganizationAddMemberRolesRequest {
            Roles = [adminRole.Id]
          }
        );
        // 👆 new code

        //...existing code...
    } else {
      Message = "Organization name is required.";
    }    
  }

//...existing code...
```

The first code block creates the two roles if they already don't exist. The second code block assigns the admin role to the user in the context of the current Organization. Let's take a closer look at the code:

```csharp
        //Create admin role if it does not exist
        Role adminRole;
        var adminRoleList = await managementClient.Roles.GetAllAsync(
          new GetRolesRequest {NameFilter = "admin"}
          );

        if (adminRoleList.Count == 0)
        {
          adminRole = await managementClient.Roles.CreateAsync(
            new RoleCreateRequest
            {
              Name = "admin",
              Description = "Manage the organization's configuration."
            }
          );
        } else {
          adminRole = adminRoleList[0];
        }
```

This part creates the *admin* role. It defines the `adminRole` variable and uses the `GetAllAsync()` method of the `Roles` object to get the *admin* role from your Auth0 tenant. Notice the filter passed as a parameter to get just the role named `admin`.

> Check out the [Management API reference documentation for more details on role management](https://auth0.github.io/auth0.net/api/Auth0.ManagementApi.Clients.RolesClient.html). 

If the *admin* role does not exist in your Auth0 tenant yet, you create it using the method `CreateAsync()` of the `Roles` object. In this case, you pass a `RoleCreateRequest` instance with the role's name and a description.

If the *admin* role already exists in your Auth0 tenant, you simply assign it to the `adminRole` variable.

Similarly, you create or get the *member* role with the rest of the code.

> You may choose to [create roles for your SaaS application using the Auth0 dashboard](https://auth0.com/docs/manage-users/access-control/configure-core-rbac/roles/create-roles). In this case, you do not need the code shown above; you only need to retrieve the *admin* role and then assign it to the user you are about to create.

After creating the user for the new Organization, you assign them the *admin* role with the following code:

```csharp
        // 👇 new code
        //Assign admin role to the new member
        await managementClient.Organizations.AddMemberRolesAsync(
          organization.Id,
          UserId,
          new OrganizationAddMemberRolesRequest {
            Roles = [adminRole.Id]
          }
        );
        // 👆 new code
```

You used the `AddMemberRolesAsync()` method of the `Organizations` object by passing the Organization ID, the user ID, and the role ID embedded in an `OrganizationAddMemberRolesRequest` instance. Read the [documentation reference](https://auth0.github.io/auth0.net/api/Auth0.ManagementApi.Clients.IOrganizationsClient.html#Auth0_ManagementApi_Clients_IOrganizationsClient_AddMemberRolesAsync_System_String_System_String_Auth0_ManagementApi_Models_OrganizationAddMemberRolesRequest_System_Threading_CancellationToken_) to learn more about the parameters of the method.

Your B2B SaaS application now has users and roles for its Organizations.

## Applying Role-Based Access Control

Once you have role support in the context of the Organizations, it's time to leverage them to control access to your application.

### Building and protecting the dashboard

As mentioned earlier, we will allow admin users to access a dashboard while Organization members will not.

Create a `Dashboard` folder in the `MyBlazorSaaS/Components/Pages` folder and add a `Home.razor` file with the following content:

```csharp


@page "/dashboard"
@attribute [Authorize(Roles = "admin")]

@inject IAuth0Management auth0Management

<PageTitle>Dashboard</PageTitle>

<h1>Welcome to your dashboard!</h1>

<div>
  <div class="form-group row my-2">
    <label for="organizationName" class="col-sm-4 col-form-label">Organization</label>
    <div class="col-sm-6">
      <InputText 
        type="text"
        @bind-Value="OrganizationName"
        id="organizationName"
        class="form-control"
        disabled/>
    </div>
  </div>
</div>

@code {
  [CascadingParameter]
  private Task<AuthenticationState>? authenticationState { get; set; }
  private string OrganizationName = "";

  protected override async Task OnInitializedAsync()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;

      if (state.User?.Identity?.IsAuthenticated??false)
      {
        var organizationId = state.User?.FindFirst(c => c.Type == "org_id")?.Value??String.Empty;
        if (!string.IsNullOrEmpty(organizationId))
        {
          var managementClient = await auth0Management.getClient();
          var organization = await managementClient.Organizations.GetAsync(organizationId);
          OrganizationName = organization.DisplayName;
        }
      }
    }
  }
}
```

This code defines a page that simply shows the Organization name in a readonly textbox. Notice the `Authorize` attribute at the beginning of the Razor component. It specifies "admin" as the user role authorized to access this page.

Now, open the `Home.razor` file in the `MyBlazorSaaS/Components/Pages` folder and add the markup highlighted below:

```html




@if (!string.IsNullOrWhiteSpace(OrganizationMessage)) {
  <div class="alert alert-success" role="alert">
    @OrganizationMessage
  </div>
}


<AuthorizeView Roles="admin">
    <Authorized>
      <div class="text-center">
        <p>Manage your Organization</p>
        <a href="Dashboard">Dashboard</a>
      </div>
    </Authorized>
</AuthorizeView>



```

The `AuthorizeView` component shows the dashboard link only to users with the admin role.

### Making roles available to your Blazor app

One little step is missing to get role support working in your B2B SaaS Blazor application. You need to create an [Auth0 Action](https://auth0.com/docs/customize/actions) that handles the [Post Login trigger](https://auth0.com/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger) by adding the user's roles to the ID token.

Read [this article to learn the details about making roles available to your Blazor application](https://auth0.com/blog/role-based-access-control-in-blazor-apps/#Making-Roles-Available-to-the-Application).

Basically, the Auth0 Action you need to create has the following code:

```javascript
exports.onExecutePostLogin = async (event, api) => { 
  const roleClaim = 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role';

  if (event.authorization) { 
    api.idToken.setCustomClaim(roleClaim, event.authorization.roles);
  }
}
```

Make sure to deploy and add your Action to the login flow. Read [this article for an introduction to Auth0 Actions](https://auth0.com/blog/introducing-auth0-actions/).

## Testing Role-Based Access Control in Your Organization

Now it's time to test your Blazor application to ensure that users access it based on their assigned roles.

### Testing as an Organization admin

Run the application and create a new Organization by clicking the *Subscribe* link in the upper right corner of the home page. The newly created user will be assigned the admin role, so after the Auth0 Organization is created, your home page should look like the following picture:

![Blazor B2B SaaS application home page with a link to manage the organization for admin users](https://images.ctfassets.net/23aumh6u8s0i/2sHsCL5X0Jef40upiskLQ5/d57fa0a8511a4f4a7f52e18d77a598ec/homepage-admin-access.png)

Notice the link "Manage your Organization" in the center of the page. Navigating that link, you will see the following page:

![Admin dashboard in a Blazor B2B SaaS application showing the organization name](https://images.ctfassets.net/23aumh6u8s0i/XwvP3tm9SzdyMMlpRh7Do/5ddcd30334cb4ac6e75fd3384799e33b/blazor-app-admin-dashboard.png)

As an admin in the current Organization, you can access the application's dashboard.

### Testing as an Organization member

Now, log out of the application and [add a member to the Organization using the Auth0 dashboard](https://auth0.com/docs/manage-users/organizations/configure-organizations/assign-members) and [assign the member role](https://auth0.com/docs/manage-users/organizations/configure-organizations/add-member-roles). You will learn how to add a member to an Organization through your application's dashboard in a future article.

If you log in to your Blazor app as a member user, you'll get the following home page:

![Home page of a Blazor B2B SaaS application for a member user, without the organization management link](https://images.ctfassets.net/23aumh6u8s0i/7qHAZhM7Ls7HZAdk565eQA/5cf22a865c4f1b6b08dc194aeeb7a88d/homepage-member-access.png)

As an Organization member, you will not see the link to access the application dashboard.

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Recap

In this article, we walked through setting up Role-Based Access Control (RBAC) for a B2B SaaS Blazor application using Auth0 Organizations. Basically, you learned how to create roles like "admin" and "member" using the Auth0 Management API and then assign them to users belonging to an Organization.

You also set up an Auth0 Action to add user roles to the ID token for your Blazor app.

Finally, we showed how to protect routes and content using the `Authorize` attribute and the `AuthorizeView` component based on these roles. We tested with both admin and member roles to confirm that RBAC was working, making sure only the authorized users could get into the dashboard.

You can find the final code of the sample project implemented throughout the article [here](https://github.com/andychiare/MyBlazorSaaS/tree/roles-organizations).

In a future article, we will add the ability to create new users to the dashboard. Stay tuned!

Implementing Role-Based Access Control in Your Blazor B2B SaaS Application

Elizabeth de Moll

As an engineering manager, Elizabeth de Moll builds teams and drives the execution of feature delivery. Though she began her career as a lawyer, please don’t hold that against her. She is passionate about engineering leadership, supporting women in tech, and coaching engineers.

Manager, Engineering

March of 2023 rolled around much like any other March at an enterprise tech company. Purple heart emojis popped up across Slack messages, and the usual statements were made about the importance of Women’s History Month. Vice President of Engineering Monica Bajaj wanted this year’s Women’s History Month to be different. She wanted the folks engaged in our Women in Engineering group and the larger Women at Okta community to [take action and make history ours](https://auth0.com/blog/women-s-history-month-women-in-engineering/). Inspired by Monica’s call to action, I’m sharing my own experience as a woman in tech, hoping the story will resonate with others and inspire even one other person.

My story of being a woman in tech begins with the story of another woman - my mother. My mother graduated from law school in the 1970s. She became a lawyer at a time when less than 12% of all lawyers in the United States were women, at a time when my grandfather warned her not to learn how to type for fear she would be relegated to a secretarial role, and at a time when women were expected to wear skirts and heels to work each day. My mother hustled and overcame the odds to eventually become a Vice President at Citibank in the 1980s, a roundabout way of saying my mother was –and still is – a badass.

Fast forward to 2015, and I graduated from law school. That’s right! I once dabbled with the dark side and practiced law. Jokes aside, though it wasn’t the right field for me, I have nothing but admiration for the many wonderful lawyers I know, including the incredible corporate legal team who needed to proofread this blog for publication! I graduated at a time when just under 40% of lawyers in the United States were women, which is a huge leap from 40+ years prior when my mother graduated. My mother was thrilled, and I remember us both feeling so proud of the progress and representation of women in the legal field. The world was changing! Opportunities were increasingly available to women! Surely, this progressive and inclusive mindset must be expanding across every field - right?

I quickly learned this wasn't the case when I switched fields from law to software engineering. Only around 20% of software engineers in the United States are women. Out of a cohort of forty students, I was one of eight women in my coding boot camp. Only three of us are still software engineers today. A recent study showed that [50% of women leave their careers in tech by the age of thirty-five](https://www.fastcompany.com/90975256/women-hold-just-27-of-tech-jobs-here-are-5-research-backed-potential-solutions). This rate is 45% higher than the rate at which men leave their careers in tech. Many assume this career cliff has to do with women reprioritizing and focusing on their families, but often, the reason many women abandon their careers in tech at this staggering rate is because of how hard it is to be the “only.”

From the day I stepped into coding boot camp to today as an experienced engineering manager at a well-known and progressive corporation, I’ve experienced being the “only” in a meeting, on a team, and even in an entire department more times than I can count. Being the “only” can be isolating, but over time, I've learned many lessons and implemented the following strategies to help alleviate loneliness, build connections, and foster community.

## Connect with Your Peers

While being the “only” or even being one of a few can be challenging, it’s important to remember that you’re not alone, and the best way to do this is to connect with your peers. At Okta, we are fortunate to have the largest, most incredible, and most talented pool of women engineers I’ve encountered in my career, which provides an amazing network to tap into right at work. Being part of our Women in Engineering group means you can hang out at WinE Time on Fridays, listen to cool technical talks or reach out to your fellow women engineers with one-on-one coffee chats. By joining WOkta (Women of Okta), you get the same fellowship and the chance to engage beyond the engineering bubble. Outside of Okta, there are local women's engineering groups or women in tech groups in many locations for you to connect with in person. Personally, I’m a big fan of [Women Who Code](https://www.womenwhocode.com/). From panels on The Danger of Burn Out to Advocating for Yourself, I’ve always felt seen and incredibly uplifted after attending Women Who Code events. However you choose to connect, finding a group that speaks to you is important. 

## Make Peace with Imposter Syndrome

I’m going to say the thing no one struggling with imposter syndrome wants to hear: imposter syndrome never goes away. There will always be a little voice questioning if you’re qualified enough or flat-out trying to convince yourself that you’re not. The most important thing you can do is make peace with that voice. First, recognize that imposter syndrome tends to rear its ugly head most when you’re doing something new and scary. If you’re feeling its effect, you’re probably pushing yourself outside your comfort zone, becoming even more awesome than you already are. Use it as a sign that you are heading down the right path. Second, practice telling that voice to “Shut up.” It doesn’t know you or the amazing things you’re capable of. You’re a woman in tech! Just by doing what you do daily, you defy the odds. That voice will get quieter with practice. Third, it’s not enough to neutralize that negative voice; you must practice the positive. You have to do whatever you need to get into a headspace where you believe you can do all the things. For me, this usually involves a ten-minute dance party in my office to psych myself up. (Thankfully, I work from home.) For you, it may be the same (we should have a dance party sometime), or it may be reviewing all the accomplishments you kept track of in your brag sheet. For others, it may be picturing where they see themselves in five years and feeling excited that this next opportunity will help them get there. Whatever action gets you telling yourself, “I can do this!” is the one you should incorporate into your routine.

## Find a Sponsor

As women, we get a lot of advice about having mentors and the importance of mentorship in our careers, but we don’t often hear about the importance of having a sponsor. Mentorship is important, and I encourage everyone to develop a mentorship. What does developing a great mentorship look like? It can be as simple as setting up recurring one-on-one meetings, having “coffee chats,” getting their feedback on your pull requests, or getting vulnerable and asking for advice. Let me share the worst-kept secret: people love being asked for their advice, so don’t feel awkward about being the first to reach out. Also, great mentor relationships can last a lifetime, and you’re not limited to just one. Having multiple mentors with expertise in different areas can help round out your personal and career growth.

So, where do sponsors fit in? Studies show that mentorship can look quite different for men and women. Women often get advice on how they should change, while men tend to get concrete steps they should take to advance their careers. A sponsor uses their power and influence to advocate for you. Everyone reading this, women and men, should find a sponsor (or multiple sponsors). You need someone who will say your name in the rooms you aren’t in yet –someone who knows your value and will help open doors for you. Don’t think that your work alone will do the talking for you or that having a sponsor means you somehow achieved less on your own. Think of it as the professional “alley-oop” we all need to get ahead. No one has to go it alone.

## Find Your Person

Yes, joining peer groups is wonderful, and ideally, we’d all tell our imposter syndrome to take a hike, but for days where those tactics aren’t enough, find your person. What do I mean by your person? Find that other woman in tech who doubles as your personal hype-woman, who will help build you up when self-doubt creeps in, and who will give you that ultimate confidence boost you need to succeed — the one who will proofread your Slack messages and will sit through practice rounds of your big presentation. Don’t ever feel like you need to be strong alone. 

## Pay it Forward

I was fortunate enough to be inspired by another woman in tech to become a software engineer. She guided me and, most importantly, helped me build the confidence to embark on a journey that would change the entire trajectory of my career. When I doubted myself and my abilities, she gave me the encouragement I needed to keep going. I owe her so much that I will never be able to pay back. What I can do is pay it forward. You don’t need to change the landscape of women in tech overnight. Just try your best to make the experience better in any way you can for someone else: share your experiences, become a mentor, set up that coffee chat, and elevate each other’s voices. In short, take action! This support is the secret sauce. This fellowship is how we get more women to join tech and stay for the long haul.

When my mother and I celebrated the higher number of women practicing law, that number didn’t improve by happenstance. It got better because of trailblazing women like my mother, women who didn’t let the odds intimidate them and who showed up ready to do the work every day while supporting those around them. We can do the same thing within tech. Together, we, the amazing women here at Okta and our incredible allies, can have the same impact and improve the representation and experiences of women in tech. There’s no better time to start than today.

We’ve built an amazing community here at Okta; we’d love for you to join us! Check out the [Careers Page](https://www.okta.com/company/careers/) to learn more about our current opportunities.

An Open Letter to Women in Tech

Learn how to use roles in your Blazor Server and WebAssembly applications to implement the RBAC authorization model.

Role-Based Access Control in Blazor Applications

Majid Hajian

I am a Google Developer Expert and Media Developer Expert and a passionate software developer with years of developing and architecting complex web and mobile applications. my passions are Flutter, PWA, and performance. I love sharing my knowledge with the community by writing and speaking, contributing to open source, and organizing meetups and events.

Google Developer Expert

In this tutorial, you’ll learn how to enhance your Flutter apps by enabling authentication, supporting federated identity providers, adding authorization by introducing roles and permissions, all leveraging Auth0.

In the exercise from the previous section, you added Auth0 authentication to an existing Flutter app. This added a username/password authentication flow to the app. You also gave the app the ability to request and submit refresh tokens, which enhance the user experience by not requiring the user to authenticate every time they use the app.

This section will expand on the app by examining some useful Auth0 features:

* Refresh token rotation
* Social logins
* Managing your Auth0 account

> **Look for the 🛠 emoji if you’d like to skim through the content while focusing on the build and execution steps.**


## Add Refresh Token Rotation

When the app makes an authentication request to Auth0’s authentication server, it includes the `offline_access` scope. This causes the authentication server to issue a refresh token, which the app can use to re-authenticate without requiring the user to log in again. The app stores this token in the device’s secure storage.

While this enhances the app’s user experience, it also introduces risk. The refresh token is long-lived, and the app could use it as a “lifetime pass” to endlessly request new access tokens and keep the user logged in forever.

I highly recommend taking advantage of *Refresh Token Rotation* and *Automatic Reuse Detection* to help mitigate this risk. With these features enabled, each refresh token can be used only once. When the app exchanges its refresh token for a new access token, the authentication server also returns a new refresh token and invalidates the old one. 

Let’s enable these features!

🛠 Navigate to the **Applications** section of your Auth0 dashboard, select the **MJ Coffee** application, and then select its **Settings** tab. Scroll down the page to the **Refresh Token Rotation** section and turn on the **Rotation** and **Absolute Expiration** options:

![Turn on the “Rotation” and “Absolute Expiration” options.](https://images.ctfassets.net/23aumh6u8s0i/6EizPZZnkGjxoAOle1Q8eL/e06c99f4a49413572736bbf0f470436c/rotation_and_absolute_expiration.png)

It is recommended that you issue a refresh token that expires after a preset lifetime. The refresh token’s lifetime can be extended each time one is used to get a new access token or access token/refresh token pair.

There are two options for token lifetimes, and they can be set independently of each other:

- **Absolute Lifetime:** Enabling **Absolute Expiration** sets a specified *absolute lifetime* for the application’s refresh tokens. Refresh tokens can be exchanged for new access tokens during this lifetime. Once the token’s age goes past its lifetime, the user will need to re-authenticate in order to get a new access token. If **Absolute Expiration** is disabled, the refresh token has an indefinite absolute lifetime.
- **Inactivity Lifetime:** Enabling **Inactivity Expiration** specified *inactivity lifetime* for the application’s refresh tokens. Refresh tokens can be exchanged for new access tokens if the user is active in the application during this lifetime. If the user is inactive in the application for a period longer than the inactivity lifetime, they will need to re-authenticate in order to get a new access token.

🛠 Scroll to the bottom of the page and click the **Save Changes** button:

![The “Save Changes” button. The user is directed to click it.](https://images.ctfassets.net/23aumh6u8s0i/7KsLW4adJ6PNIPAI12al4g/f2c0e8abf6d7377595cfb7df11493e67/save_changes.png)


## Social Logins

These days, it's pretty common to have login methods beyond the standard username/password combination. These include logging in with social media account, which will significantly enhance your users’ experiences.

Implementing these additional login methods and adding them to your authorization server is time-consuming and will come with many considerations and risks. 

Luckily, Auth0 provides lots of integration with well-known third parties’ authentication systems, and even allows you to write your custom connections. Let's add connections to both Google’s and Apple’s authentication systems.


### Create a Google/Gmail social connection

🛠 In the Auth0 dashboard, select **Authentication** in the left column menu, then select **Social**. This takes you to the **Social Connections** page, where you should click the **Create Social Connection** button:

![The steps to create a new social connection in Auth0](https://images.ctfassets.net/23aumh6u8s0i/61w1eXrbY7bGOpNo6ODbaU/da810c63bacd28cabf71e6dee4baa349/create_social_connection.png)

You will be taken to the **New Social Connection** page, which has a list of social login providers that integrate with Auth0. 

🛠 Select **Google**:

![Selecting Google from all the available social connections](https://images.ctfassets.net/23aumh6u8s0i/2YdUxIkwmCTcc9QFlo584q/22f7fd0bf4bc1c93c4ebc555e21009f8/select_google.png)

You will now be on the  **New Google / Gmail Social Connection** page, which tells you what kind of user information is accessed by Google social login.

🛠 Click **Continue**:

![Initial page for creating a new Google/Gmail social connection](https://images.ctfassets.net/23aumh6u8s0i/2SQwtF0vqtXJucnGbE3DNS/baf5bd9d7103a6ecbd59b879bbe2aaf4/click_continue.png)

A new page with a number of fields will appear; this is the connection’s **Settings** tab. 

As long as you’re working in a development environment, you only need to fill the **Name** field (which provides a name for this connection) and leave all the other fields empty. You can always use the default value in the **Name** field:

![New Google/Gmail social connection](https://images.ctfassets.net/23aumh6u8s0i/7Jzsn4ryILOOdACN2urlSo/fdaa205ef09352c0b9aba0acbd592977/new_google_gmail_social_connection.png)

However, production apps require you to provide a **Client ID** and **Client Secret** ([doc](https://auth0.com/docs/connections/social/google)) and specify the **Allowed Mobile Client IDs**. These topics will be covered in another video or article.

🛠 Create the Google/Gmail connection by scrolling to the bottom of the page and clicking **Create**:

![Creating the Google/Gmail connection](https://images.ctfassets.net/23aumh6u8s0i/4S8AJUaj4xehVwVxhNDt5X/69eb88b8bec557d310d0e9d678fe9b7e/click_create.png)

This will create the connection, and you’ll be taken to its **Applications** tab. You’ll see a list of your applications, which will allow you to enable the Google/Gmail connection for any of them. Enable the connection for the *MJ Coffee* application:

![The Google/OAuth2 applications tab](https://images.ctfassets.net/23aumh6u8s0i/681u1RRcha4ABJJ5GRZivy/c7eea90ca4e19ec5ab3b333caa47e5ba/google-oauth2_applications_tab.png)

You may also set more permissions that the end-user will need to approve during authorization. These permissions depend on your application and what you want to do on behalf of the user. The *MJ Coffee* app doesn’t need any extra permissions beyond the basic and extended profile.

![Google Permission](https://images.ctfassets.net/23aumh6u8s0i/13CvLX8tQUTuqU6jpZ6K94/a0eaac13b8fc83fc11b3ca3f6651ebd9/google_permissions.png)

🛠 Make sure you sync user profile attributes at each login and hit the **Save** button.


### Create an Apple ID social connection

🛠 Once again in the Auth0 dashboard, select **Authentication** in the left column menu, then select **Social**. This takes you to the **Social Connections** page, where you should click the **Create Social Connection** button:

![The steps to create a new social connection in Auth0](https://images.ctfassets.net/23aumh6u8s0i/1sohaZxDHuq8X8ZvT5nhvE/d2b7a7e2647708327f8fc6971ddb43a9/create_connection.png)

🛠 This time, select **Apple**:

![Selecting Apple from all the available social connections](https://images.ctfassets.net/23aumh6u8s0i/3JAgbtDSNOsfYrjxkE1wCI/e51d80f7418706c29cd6e9dc06b93719/select_apple.png)

You will now be on the  **New Apple Social Connection** page, which tells you what kind of user information is accessed by Apple social login.

🛠 Click **Continue**:

![Continue](https://images.ctfassets.net/23aumh6u8s0i/3zt2ntLwoHwp6bldLmOOsD/8db3e7f5c057d5782c7202b748013420/click_connect_-_apple.png)

As long as you’re working in a development environment, you can leave the **Client ID** and **Client Secret Signing Key** fields empty. You *will* need proper keys for those fields when the app goes to production; [this document covers that topic in more detail](https://auth0.com/docs/connections/apple-siwa/set-up-apple).

The **Apple Team ID** and **Key ID** values are required:

![Google Permission](https://images.ctfassets.net/23aumh6u8s0i/2qNvT5zkxB1TY06ywkH5Re/7c46fa1399743de9e7bb05d1d804fab0/apple_dev.png)

* To get your Apple Team ID, you need an Apple Developer Account.
* To get a Key ID for your app, you need to register that app using your Apple Developer Account. 

🛠 Sign in to your Apple Developer Account, and go to the **Membership** page and make a note of your Team ID.

🛠 If you have a registered app, you can skip the following steps and jump to the list of tasks for creating a service ID. Otherwise, follow the steps below:

- In the Apple Developer Portal, go to **Certificates, IDs, & Profiles > Identifiers** and click the blue “plus” icon next to **Identifiers** to create a new App ID.
- Choose **App IDs** as the identifier type and click **Continue**.
- Provide a description and a Bundle ID in reverse-domain name format (e.g.: `com.mydomain.mjcoffee`).
- Scroll down and check **Sign In with Apple**.
- Click **Continue**, and then click **Register**.

🛠 Once the app is registered, it’s time to create a service ID:

- Return to the **Certificates, IDs, & Profiles** section, and click the blue “plus” icon next to **Identifiers**.
- Choose **Service IDs** and select **Continue**. Fill in the description and identifier (e.g.: `com.mydomain.mjcoffee`).
- After checking **Sign In with Apple**, select **Configure**, and define your Web Domain (e.g.: `com.mydomain.mjcoffee`) and your "Return URL". Ensure that your Return URL is your Auth0 domain and that it follows this format: `https://YOUR_AUTH0_DOMAIN/login/callback`.

![Return URL apple sign in](https://images.ctfassets.net/23aumh6u8s0i/5Wetff0Tutv55UXsYz0gKq/ab19cd3e48604aea314410d22d194982/callback_apple.png)

🛠 Finally: save, continue and then register the service.


#### Set up your Client Secret Signing Key

🛠 Follow these steps:

- Go to **Keys**, which is located in the **Certificates, Identifiers, & Profiles** section of your Apple developer dashboard.
- Select the blue “plus” icon to add a new key.
- Enter a **Key Name** and check the **Sign In with Apple** option.
- Select **Configure** to make sure the **Choose a Primary App ID** field is filled with the correct App ID.
- Select **Save, Continue**, and then **Register**.
- On the page to which you're redirected after registering, make a note of the Key ID. Then download the key; it will have a `.p8` filename extension.

🛠 Go back to your Apple social connection settings and paste the Key ID. Ensure the proper attributes are selected (Name, Email) and sync user profile at each login is enabled. Hit **Save**.


## Enable Social Connections

🛠 Once you have created all your social connections and set them up correctly, go back to your applications. Go to the **Connections** tab and enable your newly-made social connections:

![app social connections](https://images.ctfassets.net/23aumh6u8s0i/59SCRbiX055qDcmTSNwPVl/fa175f974ceb43515893f24f7747d549/app_social_connections.png)

As you can see, adding and removing social connections for your apps is now as simple and flicking a switch.

On the Flutter side, I have good news: you don’t need to implement anything there! 

Restart the app, log out, then try to log in. You’ll see this:

![app social connections](https://images.ctfassets.net/23aumh6u8s0i/4b6BIaeZ8EHcN1a3MYVOrF/91c9039cf0d56051c99397d1a7524a3e/social_buttons_flutter.png)

That's it! The login screen will now display social login buttons, and their login flows will be ready to use.


## Branding 

While it’s fine to use the default branding in development, you want the login page to be customized to your “look and feel” once the app’s in production.

Auth0 allows you to customize your login page through a number of options. You can change the look and feel of the login page by adding colors and logos, and you can customize the user notification part of the process as well: email templates, text messages, and so on. It’s all in the **Branding** section of the Auth0 dashboard:

![Auth0 branding](https://images.ctfassets.net/23aumh6u8s0i/7oq6VzFQ3nSUcStZTXvjQu/38d1e272f3bef751d9feaca704d580dc/branding.png)


### Add Roles

You may want to provide certain functionalities to the user based on their roles. This is easy with proper authorization server such as Auth0, which facilitates adding roles and specifying what users in each role are allowed to do. 

In the MJ Coffee app, there are three different roles:

- **Admin:** These are administrators, and they will have access to all the app’s functionality with full permissions.
- **Customer:** This is the default role for registered or logged-in users. They are limited to the app’s customer-facing features. You will automatically assign this role to all users upon registration or login, and you will learn how to do so later on in this tutorial.
- **Employee:** These are coffee shop employees. They can access the community screen to answer customer requests in the support chat, as well as other employee-facing features.

![Auth0 roles](https://images.ctfassets.net/23aumh6u8s0i/7nVdiU86TPCF1tLXrBg6ID/54a078bfe7d2382a6776c26adfc5cba4/roles.png)

You can add more roles to the app as the need arises.


## User Management in Auth0

Auth0 provides the infrastructure to store users and their information on its cloud database.

For the *MJ Coffee* app, Auth0’s cloud database is sufficient. One of Auth0’s goals is to reduce the cost of extra infrastructure maintenance and cost.

You can access users by selecting **User Management** in the left column menu of the Auth0 dashboard. The **Users** page allows you to create new users and manage your existing ones by changing their details, adding permissions and roles, or revoking their access.

![Auth0 users](https://images.ctfassets.net/23aumh6u8s0i/3O0JDGBqXHmPfrKaEavP2D/260c804cf50a308e696ecd9a446ab4a9/users.png)

When you open a user, you’ll see that Auth0 provides in-depth details about that user, including basic account data, metadata, their devices, and their history, which might be pretty helpful for debugging the application or investigating a particular user’s access activity, permissions, and roles.

![Auth0 user roles](https://images.ctfassets.net/23aumh6u8s0i/JcGTMspZ9hKtu9RAi4Oq9/257a692aa9a65cd12e96f645b56aafd1/user_roles.png)

Each user account stores some basic information about the user: name, email address, the date and time when the account was created, and so on. 

Additional information can be attached to a user by adding to these metadata stores:  their user metadata, which is a key-value structure for storing information about the user. You can also store information in the user_metadata or manipulating `app_metadata`, which helps to provide more information to the Flutter application while receiving user details.


## Moving Forward

In the next section of this tutorial, you will learn how to add real-time chat to the app.


Flutter Authentication and Authorization with Auth0, Part 2: Refresh Tokens, Social Logins, and More

Flutter Authentication and Authorization with Auth0, Part 1: Adding Authentication to an App

Brittney

Brittney Liburd has been helping teams go to market with SaaS and security technologies for over 12 years. An avid researcher and writer, Brittney has a passion for artificial intelligence, machine learning, and the #goodIDmovement. She also has a near-encyclopedic knowledge of George RR Martin's “ A Song of Ice and Fire” book series.

Sr. Product Marketing Manager at authID

Brittney Liburd

Advanced facial biometrics can enhance Auth0 MFA workflows to provide secure authentication experiences that simplify common challenges for technical roles.

On a daily basis, CIAM professionals battle data breaches, account compromise, ransomware, and fraud. In 2021, digital fraud rates increased 22%, ransomware rates increased 62%, data breach rates increased 17%, — and cybercriminals shifted to softer targets with more valuable data and motivation for ransom payout. Huge shifts in remote work, distance learning, telemedicine, and BYOD trends also added layers of complexity as organizations struggled to protect systems and data.  

These trends illustrate the complex CIAM challenges facing technical roles in B2B, B2C, and B2E environments. Developers, engineers, systems architects who are responsible for CIAM and fraud prevention will find this post most valuable, as we will discuss how facial biometric authentication can strengthen identity assurance while simplifying challenges in implementation, operations costs, security needs, and CX expectations.  

## Facial Biometric Authentication

> Facial Biometric Authentication can help technical roles secure enterprise assets while simplifying the user experience.

Finding the right balance between user convenience, privacy, and security is today’s biggest challenge for developers. CIAM is a convergence of IAM, fraud detection, and authentication tools that are used for controlling user access by both internal users (your workforce) and external users (your customers). However, according to Gartner, no single tool can deliver on all the identity administration, fraud detection, access management, content management, and analytics needed to build out a holistic solution.

As a result, technical roles are left cobbling together solutions that may leave gaps in security or may increase friction in user experience that requires additional investment to remedy. Advanced facial biometric authentication seamlessly woven into the Auth0 login workflow can provide the needed balance between a frictionless user experience and protection against password-related fraud, phishing, and account takeover. 

## 4 Ways to Leverage Auth0 and Advanced Facial Biometric Authentication to Strengthen CIAM

Auth0 simplifies biometric multi-factor authentication for the technical teams responsible for implementing CIAM strategies and tools. This simplification is delivered in four main areas.  

* Easy Implementation with Broad Solution Support
* Operational Efficiency and Cost Reduction 
* Improved Security and Fraud Reduction  
* Enhanced User Experience 

### Easy Implementation with Broad Solution Support

Users today shop, play and work using a broad range of mobile devices and desktop computers, and operating systems. So technical roles need a strong authentication solution that is device-agnostic and capable of supporting everyone interacting with your platform. Biometric authentication that offers portability without being tied to a specific device, an authenticator fob, or an authenticator app also provides the right balance between enhanced platform security and increased user satisfaction and adoption.

### Operational Efficiency and Cost Reduction

Operational inefficiencies caused by complex authentication experiences impact customer loyalty and workforce productivity, with negative impacts on revenue and profits as businesses move slower and customers are lost. B2B, B2C, and B2E focused organizations using Auth0 can improve operational efficiencies and reduce related costs with authentication solutions that are applicable for many use cases across multiple devices. To simplify CIAM for technical roles - focus on finding a solution for user authentication that can serve internal, external, and developer use cases. Facial biometrics can support authentication use cases, including online or mobile app login, chat or call center support, as well as strong authentication for valued transactions and account activity. Also, remember solutions that require complex maintenance should be avoided in lieu of a solution that simplifies administration requires no additional hardware, training, or mental burden on behalf of the user. 

### Improved Security and Fraud Reduction

Advanced facial biometric authentication reduces the risk of account misuse and takeover by requiring the live face of a registered user as a factor for authentication and a condition for access. Even in the event of password or credential compromise, advanced facial biometrics will stop unauthorized access from occurring. Facial biometric multi-factor authentication addresses many fraud-related concerns, including the ability to stop account takeover and quickly authenticate the validity of transactions flagged for manual review. 

### Enhanced User Experience

Including advanced facial biometrics as a factor for authentication within your Auth0 workflow delivers a sophisticated digital experience by balancing strong authentication with customer expectations of low friction authentication and easy access. Today’s users—whether they are shopping, working, or banking – sitting on the train or at their desks are demanding portability with less friction. Advanced biometric authentication eases the user burden as there is no need to download additional software or employ multiple devices for authentication. 

## Conclusion

When evaluating CIAM tools to reduce friction in or further secure your MFA workflow, consider Verified CloudConnect—the ideal bolt-on integration for Auth0. Verified™ CloudConnect delivers fortified, in-browser biometric authentication—supported across all mobile and desktop devices used to access enterprise data and resources. At login or for any transaction you deem to require additional identity assurance, the Verified browser-based UX adds an additional factor of authentication – a live selfie. Verified analysis of the selfie in real-time for biometric matching and liveness, defending user accounts from deep fakes and other spoofing attempts. 

Verified CloudConnect is a flexible, drop-in solution that seamlessly extends the Auth0 Identity Platform to secure B2B, B2C, and B2E environments without additional authentication hardware, mobile apps, or single-use pin-codes. As Gartner has noted – no one single vendor can deliver for all aspects of identity and access management. Adding a tool like Verified CloudConnect for Auth0 will improve user experience, thereby increasing user adoption and retention. Deployed easily with a simple line of code, Verified enhances your current security stack while reducing operational costs and overall solution complexity.  

Ready to get started with Verified CloudConnect for Auth0? Visit [authID.ai listing](https://marketplace.auth0.com/integrations/verified-biometric-mfa) on the Auth0 Marketplace for more information.

4 Ways to Strengthen Identity Authentication for Technical Roles

What is the best way to apply Role-Based Access Control (RBAC) to your ASP.NET Web API? Let's find out together.

Role-Based Authorization for ASP.NET Web APIs

Flutter Authentication and Authorization with Auth0, Part 4: Roles and Permissions

Flutter Authentication and Authorization with Auth0, Part 3: Adding Real-Time Chat to the App

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Learn how to use NestJS, a Node.js framework powered by TypeScript, to build a secure API.

Developing a Secure API with NestJS: Managing Roles

sandrino-di-mattia

Principal Architect

Sandrino Di Mattia

Introducing the new version of our Authorization Extension which adds support for roles and permissions



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---
## Background

Authentication has always been the core of Auth0. But once you know who your users are, you’ll probably also need to know what they can do. Therefore, after authenticating users, you’ll need to authorize them. There are so many different ways to do this, from complex products to home-grown solutions. Using our rules engine, you could also consume this information during the login process.

## Concepts

The Authorization Extension which you can now install using the Extensions tab in the dashboard, tries to provide customers with a generic approach to managing authorization using three top-level concepts:

 - Groups
 - Roles
 - Permissions

### Groups

Groups are collections of users. They are a common way to organize users in enterprise directories like Active Directory. A company might create a group for every department, such as HR, Finance, Accounting, and IT.

Users can be added to one or more groups. But groups can also be nested, with members of one group automatically added as members of another group.

![An example of the "Finance Group"](https://images.ctfassets.net/23aumh6u8s0i/4aLHeBTDYJPNw1d4N0NZp9/2006be77627c5145502aa4e03a190fb8/group)

The main reason for having groups is that it allows us to group people who have the same profile within the company. It is easier to assign roles and permissions to groups than it is to individual people, who can can get sick, go on vacation or leave the company.

### Permissions and Roles

While groups are bound to an organization and not an application, the same is not true for roles and permissions.

If you look at an application that you are building, you’ll notice that users can do many things within your application. Everything your users can do are actions, including opening a record, updating one, deleting one, reporting, and changing settings. A permission determines whether you are allowed to execute an action or not, such as:

- `read:users`
- `run:reports`
- `update:settings`

![Permissions are granual actions that you can execute within an application](https://images.ctfassets.net/23aumh6u8s0i/5AwgqESXywzDYhMjTIE1qc/d86f2afabe3bbf22beaad7b7ed4da0c3/permissions)

These permissions only make sense within the application. A `generate:invoice` permission might make a lot of sense in your accounting application but no sense at all in your planning tool. Therefore, permissions represent actions that you can execute as a user within an application, and roles are there to group these permissions into logical collections.

A timesheet application can have a **Timesheet User** role and a **Timesheet Manager** role. A user will have certain permissions, such as `read:timesheets` `update:timesheets`, and `create:timesheets`, while a manager will have additional permissions, such as `approve:timesheet` and `reject:timesheet`.

![Roles are used to organize your permissions](https://images.ctfassets.net/23aumh6u8s0i/19bQ09h64GAFTBMd118b2Y/ce19dbfb9141a2919632edfbafdd323f/role)

These roles can be assigned to specific users or to groups; if roles are assigned to a group, every user of that group will receive those roles (and permissions).

## Consuming this information in your applications

After setting up everything in the extension, your applications will need to consume this information. The extension offers three ways to do this:

 - Adding information to the **id_token**
 - Adding information to the user’s **app_metadata**
 - Getting the information from a **policy decision point** (PDP)

In the configuration section, you can configure the behavior of the extension. Any change you make here will deploy a rule to your Auth0 account, which will add the information to the token, the app_metadata, or both.

If you’re implementing RBAC, for example, you could just check the box to store the roles in the token. But if you need to understand which permissions a user has in a specific application later, you could make the following call to get the user’s authorization data in the context of an application:

```
POST https://sandrino-dev.us.webtask.io/api/users/ad|john@fabrikam.com/policy/9CDFQBunB9ZvYRCpFWJlzpH9tUwclGIO
```

This will return the groups, roles, and permissions for a user in the context of the current application:

```json
{
  "groups": [
    "Distribution",
    "Accounting"
  ],
  "permissions": [
    "read:own-receipts",
    "update:own-receipts",
    "update:delete-receipts",
    "read:own-reports",
    "update:own-reports",
    "delete:own-reports",
    "submit:own-reports",
    "read:receipts",
    "read:reports",
    "approve:reports",
    "reject:reports"
  ],
  "roles": [
    "Expense User",
    "Expense Manager"
  ]
}
```

## Feedback?

This extension was built using React, Redux, Hapi, and Webtask. When you install it, the entire application will run in the Webtask container of your Auth0 account.

The full source code is available at https://github.com/auth0/auth0-authorization-extension. Feel free to open a GitHub issue if you have any feedback. 

## What lies ahead

Our API authorization feature has been in public preview for some time now, and it will be interesting to use the authorization extension in that context. Depending on your use case, your permissions can be represented as **scopes** in your access token.

Here are some additional resources to get you started:

- [Official documentation](https://auth0.com/docs/extensions/authorization-extension)
- [Automatically provisioning groups, roles, and permissions](https://github.com/auth0-extensions/authz-extension-automation-sample)


Announcing the Auth0 Authorization v2 Extension!

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

A potential programming mistake raises unexpected privacy concerns among users



[Pokémon](https://en.wikipedia.org/wiki/Pok%C3%A9mon) has been a subject of passion for grown-ups and youngsters alike for a long time. The newly released Pokémon GO app is no exception: it has been installed by thousands since its release a few days ago. What they don't know is that they have given [Niantic](https://www.nianticlabs.com/), the developer, full access to their Google accounts!  

<include src="TweetQuote" quoteText="Pokémon GO has been installed by thousands and the developer has full access to their Google accounts!"/>

**Update:** Ari Rubinstein from Slack has [dived deeper](https://gist.github.com/arirubinstein/fd5453537436a8757266f908c3e41538) and performed an analysis of what can be done with tokens obtained using this authentication flow. It appears additional steps must be performed to obtain a full access token. These steps *are* possible for Pokemon GO, as it is granted access to the necessary APIs, though the app does not appear to be using them. This issue may be attributed to programming mistakes and a permissive API on the part of Google. Both Google and Niantic are looking into the issue and attempting to provide a fix as soon as possible.      

**Update 2:** Niantic has released an [official statement](https://support.pokemongo.nianticlabs.com/hc/en-us/articles/222648408-Permissions-update) regarding the Pokemon Go iOS permissions problem. And also, the app has been updated in the [App Store](https://itunes.apple.com/us/app/pokemon-go/id1094591345?mt=8) with the correct permission scopes. 

-----

## A Pokémon fan's dream game
Pokémon GO, available in [Apple's App Store](https://itunes.apple.com/us/app/pokemon-go/id1094591345?mt=8) and [Google's Play Store](https://play.google.com/store/apps/details?id=com.nianticlabs.pokemongo&hl=en), is an augmented-reality game that lets users be part of a world full of Pokémon ready to be caught. Using the phone's camera and GPS, Pokémon are distributed in the user's vicinity. Hints are displayed to give the user a notion of where to find Pokémon.
To give you an idea of what this means for your average Pokémon fan: it's wild. We've already heard stories of people going into bars just to catch Pokémon (no drinking involved (!)), others [finding corpses](http://arstechnica.com/gaming/2016/07/gamer-stumbles-onto-dead-body-while-testing-pokemon-gos-gps-fueled-features/). This is pretty much every Pokémon fan's dream game: a game that fuzzes the boundaries between fantasy and reality and lets users be part of an ever changing semi-real world full of Pokémon.

No wonder the explosion in social media. And among the many eyes looking at Pokémon GO [some](http://adamreeve.tumblr.com/post/147120922009/pokemon-go-is-a-huge-security-risk) were keen enough to notice users were giving full access to their Google accounts!

![All access in Google account](https://images.ctfassets.net/23aumh6u8s0i/18NnCNuefCyzRMLyS8EDYl/35b993c7d31ec4a45b128d6c31fa3a6a/allaccess)

## How this happened: Single-Sign-On 
We've written a lot about [single-sign-on](https://auth0.com/blog/2015/09/23/what-is-and-how-does-single-sign-on-work/) in the past. It's great, and it helps [businesses grow](http://www.appcues.com/blog/single-sign-on-the-one-click-growth-hack-youre-not-using/). Security is hard, though, and this is no exception. Most single sign on solutions sport a flow similar to the following:

1. An application, on behalf of a user, requests to login through a login provider.
2. The application redirects the user to the login provider's login screen.
3. The login provider authenticates the user and then proceeds to create an authentication/authorization token for the application to use.
4. The token is passed to the application, which can use the token on behalf of the user to perform certain operations with his/her account.

If the application has never operated on behalf of the user with that login provider, an additional step is inserted between step 3 and 4. This step is crucial and defines **what access the application will have to the user data in the login provider's system**. It is this step that is not working right in Pokémon GO.

![Have you ever seen this screen?](https://images.ctfassets.net/23aumh6u8s0i/6fDxO1JfL3WeHnivkKK4S4/6caebe064f53c55a31f147b83f36e44e/permissions)

For some reason this screen is not showing and the app is still getting full-access to Google accounts.

This means **emails (reading and sending), Google Drive documents, your browsing history, your photos, your maps and locations** are *all* available to Niantic. As far as we know, the Android version does not exhibit the same issue (unless you log in with an account previously used on an iOS device for Pokémon GO), so it was probably not the developer's intention to do this. In other words, this is probably a bug or a simple coding mistake.

Until this issue is resolved, our advice is to simply revoke the application's permissions to your Google account by going to the [connected apps page](https://security.google.com/settings/security/permissions).

**Update:** now we know why this screen is not being displayed. Read the excellent [analysis](https://gist.github.com/arirubinstein/fd5453537436a8757266f908c3e41538) by Ari Rubinstein and then take a look at [what is necessary](https://duo.com/blog/beyond-the-vulnerabilities-of-the-application-specific-password-exploiting-google-chrome-s-oauth2-tokens) to get a full access token from the one obtained by Pokémon GO. Although possible, there is no reason to believe Pokémon GO is exploting this.

## Let the experts do the hard work
Authentication and authorization are hard. Even when using the [excellent documentation provided by Google](https://developers.google.com/identity/sign-in/ios/sign-in) for their single-sign-on solution, bugs and mistakes happen. And when you are growing as fast as Pokémon GO, mistakes can be costly.

Our single-sign-on solution gives applications only minimal access to account details by default. Google, Facebook, Twitter and many other login providers are all supported and available under one click. Using a simple, safe-by-default solution can make all the difference between a costly mistake and smooth sailing. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Try Auth0 now</a> and focus on your app, not logins.

These are our default permissions for Google sign-in: 

![Auth0 default Google permissions](https://images.ctfassets.net/23aumh6u8s0i/4PCBGqxkULDuVzTZViQCgr/3e2d55768158bfb7029e06b22006586a/auth0-perms-2)

