Send Auth0 roles for role mapping

Auth0 does not put roles or groups in an ID token on its own. It also silently drops a custom claim whose name is not a namespaced URL, so a claim named plain groups or roles never reaches Workforce Intelligence. Two things fix this: an Action that sets the claim, and a namespaced claim name that you enter in Claim name.

You need the admin ability in Workforce Intelligence and access to your Auth0 tenant.

1. Create the application#

1. In the Auth0 Dashboard, create an application of type Regular Web Application.
2. Under Settings, add the OIDC redirect URI from the Single sign-on page (it ends in /auth/callback) to Allowed Callback URLs.
3. Note the Client ID and Client Secret, and your tenant's domain.

The Issuer you enter in Workforce Intelligence is https://<your-tenant-domain>/. Auth0 includes a trailing slash in its issuer, and the value must match the provider's discovery document exactly, so include it.

2. Create roles and assign them#

Under User Management > Roles, create a role for each group of people you want to map, for example wi-admins, and assign it to users. The Action below sends the names of the roles a user holds.

3. Add the Action#

1. Open Actions > Library, select Build Custom, name it, for example "Send roles to Workforce Intelligence", and choose the Login / Post Login trigger.

2. Replace the code with the following. Change namespace to a URL you control, such as your Workforce Intelligence address. It is only a label, and it does not have to resolve.

   exports.onExecutePostLogin = async (event, api) => {
     const namespace = "https://wi.company.com";
     const roles = (event.authorization && event.authorization.roles) || [];
     api.idToken.setCustomClaim(`${namespace}/groups`, roles);
   };
   

3. Select Deploy.

4. Open Actions > Flows > Login, drag the Action from Custom into the flow between Start and Complete, and select Apply.

An Action does nothing until it is both deployed and placed in the flow.

4. Configure Workforce Intelligence#

1. On the Single sign-on page, add the domain as OpenID Connect (OIDC) with the Issuer, Client ID and Client secret from Auth0.
2. Set Claim name to the exact claim you created: https://wi.company.com/groups in the example. When you set a name, only that exact name is read; the default roles and groups are not checked. Set it when you add the domain, or select Edit later.
3. Select Edit mapping, add a row for each role, with the role's name as the value, and pick its ability.

Check that it works#

Sign in as a user who holds a mapped role. Mapped abilities apply from that sign-in.

• To see what Auth0 sends, decode the ID token and look for the namespaced claim.
• If the abilities do not change, confirm that Claim name matches the namespaced name character for character and that the Action is in the Login flow.
• The email must be verified in Auth0 for sign-in to succeed.

See Map provider roles to abilities.