From f52829d16536ce6212b70dc2a14c592e0195abaa Mon Sep 17 00:00:00 2001 From: Will O'Brien Date: Fri, 21 Apr 2017 17:46:15 -0400 Subject: [PATCH] App metadata instead of user metadata (#55) From the [docs](https://auth0.com/docs/metadata): > An authenticated user can modify data in their profile's user_metadata, but not in their app_metadata. Seems role-type information should be stored in `app_metadata`. --- auth.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/auth.rst b/auth.rst index f9abc431d..ab271a11c 100644 --- a/auth.rst +++ b/auth.rst @@ -236,14 +236,14 @@ An external service like `Auth0 `_ can do the hard work tran To use Auth0, copy its client secret into your PostgREST configuration file as the :code:`jwt-secret`. (Old-style Auth0 secrets are Base64 encoded. For these secrets set :code:`secret-is-base64` to :code:`true`, or just refresh the Auth0 secret.) You can find the secret in the client settings of the Auth0 management console. -Our code requires a database role in the JWT. To add it you need to save the database role in Auth0 `user metadata `_. Then, you will need to write a rule that will extract the role from the user metadata and include a :code:`role` claim in the payload of our user object. Afterwards, in your Auth0Lock code, include the :code:`role` claim in your `scope param `_. +Our code requires a database role in the JWT. To add it you need to save the database role in Auth0 `app metadata `_. Then, you will need to write a rule that will extract the role from the user metadata and include a :code:`role` claim in the payload of our user object. Afterwards, in your Auth0Lock code, include the :code:`role` claim in your `scope param `_. .. code:: javascript // Example Auth0 rule function (user, context, callback) { - var role = user.user_metadata.role; - user.role = role; + user.app_metadata = user.app_metadata || {}; + user.role = user.app_metadata.role; callback(null, user, context); }