laravel logo
php logo
api
authorization
rbac

Laravel/PHP API: Role-Based Access Control Code Sample

api
authorization
rbac
Dan Arias
By Dan Arias, R&D Engineering ManagerLast update on November 19, 2021

This code sample demonstrates how to implement Role-Based Access Control (RBAC) in a Laravel API server using Auth0. This code sample shows you how to accomplish the following tasks:

  • Create permissions, roles, and users in the Auth0 Dashboard.

  • Use Laravel middleware to enforce API security policies.

  • Perform Role-Based Access Control (RBAC) in Laravel using a token-based authorization strategy powered by JSON Web Tokens (JWTs).

  • Validate access tokens in JSON Web Token (JWT) format using Laravel middleware.

  • Request resources that require different access levels from a secure API server.

Code Sample Specs

This code sample uses the following main tooling versions:

  • Laravel v8.75.0
  • PHP v7.4 or v8.0
  • Auth0 PHP SDK v8.0.3

The Laravel project dependency installations were tested with Composer v2.1.14.

Quick Auth0 Set Up

First and foremost, if you haven't already, sign up for an Auth0 account to connect your API with the Auth0 Identity Platform.

Next, you'll connect your API with Auth0. You'll need to create an API registration in the Auth0 Dashboard and get two configuration values: the Auth0 Audience and the Auth0 Domain.

Get the Auth0 audience

  • Open the APIs section of the Auth0 Dashboard.

  • Click on the Create API button and fill out the "New API" form with the following values:

Name
Hello World API Server
Identifier
https://hello-world.example.com
  • Click on the Create button.

Visit the "Register APIs" document for more details.

When setting up APIs, we also refer to the API identifier as the Audience value. Store that value in the following field to set up your API server in the next section:

Get the Auth0 domain

Now, follow these steps to get the Auth0 Domain value.

  • Open the Auth0 Domain Settings

  • Locate the bold text in the page description that follows this pattern: tenant-name.region.auth0.com. That's your Auth0 domain!

  • Paste the Auth0 domain value in the following field so that you can use it in the next section to set up your API server:

The region subdomain (au, us, or eu) is optional. Some Auth0 Domains don't have it.

Set Up and Run the Laravel Project

Start by cloning the Laravel project and checking out the basic-role-based-access-control branch:

git clone https://github.com/auth0-developer-hub/api_laravel_php_hello-world.git --branch basic-role-based-access-control

Make the project directory your current working directory:

cd api_laravel_php_hello-world

If you are running your project with Sail, generate a Laravel app key value using the following command:

./vendor/bin/sail artisan key:generate

If you are running your project with Composer, you can use the following command instead:

php artisan key:generate

Store the output from any of the commands above in the following field:

Now, create a .env file under the project directory and populate it as follows:

.env
APP_KEY=KEY-VALUE
SERVER_PORT=6060
CLIENT_ORIGIN_URL=http://localhost:4040
AUTH0_AUDIENCE=AUTH0-AUDIENCE
AUTH0_DOMAIN=AUTH0-DOMAIN

With your .env in place, install the Laravel project dependencies:

composer install

Execute the following command to run the Laravel API server using Sail:

./vendor/bin/sail up

Otherwise, use the following command to run the API server using Composer:

php artisan serve

Set Up Role-Based Access Control (RBAC)

Within the context of Auth0, Role-based access control (RBAC) systems assign permissions to users based on their role within an organization. Everyone who holds that role has the same set of access rights. Those who hold different roles have different access rights.

Developers who use Role-based access control (RBAC) for access management can mitigate the errors that come from assigning permissions to users individually.

You can use the Auth0 Dashboard to enable Role-Based Access Control (RBAC) in any API that you have already registered with Auth0. You then implement RBAC by creating API permissions, assigning those permissions to a role, and assigning that role to any of your users.

Whenever a user logs in to one of your client applications, the Auth0 authorization server issues an access token that the client can use to make authenticated requests to an API server. Auth0 authorization servers issue access tokens in JSON Web Token (JWT) format.

When you enable Auth0 Role-Based Access Control (RBAC) for an API, the access token will include a permissions claim that has all the permissions associated with any roles that you have assigned to that user.

For this particular API code sample, the access token present in the authorization header of a request must include a permissions claim that contains the read:admin-messages permission to access the GET /api/messages/admin endpoint.

Enable Role-Based Access Control (RBAC)

  • Open the APIs section of the Auth0 Dashboard and select your "Hello World API Server" registration.

  • Click on the "Settings" tab and locate the "RBAC Settings" section.

  • Switch on the "Enable RBAC" and "Add Permissions in the Access Token" options.

Visit the "Role-Based Access Control" document for more details.

Create an API permission

In the same Auth0 API registration page, follow these steps:

  • Click on the "Permissions" tab and fill a field from the "Add a Permission (Scope)" section with the following information:
Permission (Scope)
read:admin-messages
Description
Read admin messages
  • Click the "+ Add" button to store the permission.

Visit the "Add API Permissions" document for more details.

Create a role with permissions

Create a role

  • Open the User Management > Roles section of the Auth0 Dashboard.

  • Click on the Create role button and fill out the "New Role" form with the following values:

Name
messages-admin
Description
Access admin messaging features
  • Click on the Create button.

Visit the "Create Roles" document for more details.

Add permissions to the role

  • Click on the "Permissions" tab of the roles page.

  • Click on the "Add Permissions" button.

  • Select the "Hello World API Server" from the dropdown menu that comes up and click the "Add Permissions" button.

  • Select all the permissions available by clicking on them one by one or by using the "All" link.

  • Finally, click on the "Add Permissions" button to finish up.

Visit the "Add Permissions to Roles" document for more details.

Create an admin user

  • Open the User Management > Users section from the Auth0 Dashboard.

  • Click on the "Create user" button and fill out the form with the required information. Alternatively, you can also click on any of your existing users to give one of them the admin role.

  • On the user's page, click on the "Roles" tab and then click on the "Assign Roles" button.

  • Select the messages-admin role from the dropdown menu and click on the "Assign" button.

Visit the "Assign Roles to Users" document for more details.

Access the Admin Endpoint

Let's test access to the GET /api/messages/admin endpoint by simulating a real user login and requesting that protected resource using a real access token.

You can pair this API server with a client application that matches the technology stack that you use at work. Any "Hello World" client application can communicate with this "Hello World" API server sample.

When you log in to a "Hello World" client application as a user who has the messages-admin role, your access token will have the required permissions to access the GET /api/messages/admin endpoint.

You can simulate a secure full-stack application system in no time. Each client application sample gives you clear instructions to get it up and running quickly.

Pick a Single-Page Application (SPA) code sample in your preferred frontend framework and language:

angular
typescript
spa
authentication
spa
authentication
Angular/TypeScript App: Authentication Code Sample
Code sample of a simple Angular single-page application that implements authentication using Auth0.
react
javascript
spa
authentication
react router-6
spa
authentication
react router-6
React/JavaScript + React Router 6: Authentication Code Sample
Code sample showing how to protect a simple React single-page application using React Router 6, Auth0, and JavaScript.
react
javascript
spa
authentication
spa
authentication
React/JavaScript App: Authentication Code Sample
Code sample of a simple React single-page application built JavaScript that implements authentication using Auth0.
react
typescript
spa
authentication
react router-6
spa
authentication
react router-6
React/TypeScript + React Router 6: Authentication Code Sample
Code sample showing how to protect a simple React single-page application using React Router 6, Auth0, and TypeScript.
react
typescript
spa
authentication
spa
authentication
React/TypeScript App: Authentication Code Sample
Code sample of a simple React single-page application built TypeScript that implements authentication using Auth0.
svelte
javascript
spa
authentication
spa
authentication
Svelte/JavaScript App: Authentication Code Sample
Code sample of a simple Svelte single-page application that implements authentication using Auth0.
vue-3
javascript
spa
authentication
composition api
spa
authentication
composition api
Vue 3/JavaScript + Composition API: Authentication Code Sample
Code sample of a simple Vue 3 single-page application built with JavaScript and the Composition API that implements authentication using the Auth0 Vue SDK.
vue-3
javascript
spa
authentication
options api
beta
spa
authentication
options api
beta
Vue 3/JavaScript + Options API: Authentication Code Sample
Code sample of a simple Vue 3 single-page application built with JavaScript and the Options API that implements authentication using the Auth0 Vue SDK.
vue-3
javascript
spa
authentication
legacy
spa
authentication
legacy
Vue 3/JavaScript: Authentication Plugin Code Sample
Code sample of a simple Vue 3 single-page application built with JavaScript that implements authentication using the Auth0 SPA SDK.
vue-3
typescript
spa
authentication
legacy
spa
authentication
legacy
Vue 3/TypeScript: Authentication Plugin Code Sample
Code sample of a simple Vue 3 single-page application built with TypeScript that implements authentication using Auth0.
vue
javascript
spa
authentication
spa
authentication
Vue.js/JavaScript App: Authentication Code Sample
Code sample of a simple Vue.js single-page application that implements authentication using Auth0.