🧩 Adding Auth0 RBAC Authorization to a Ktor API
Tags: kotlin, ktor, api, authorization
Published: 2021-08-04 12:11:48

### 📚 Learn how to add Auth0 RBAC authorization to Ktor HTTP API endpoints.


### <br>
In the previous post, we created an Auth0 API to represent the Ktor HTTP API and an Auth0 application to allow the frontend application to authenticate users. This allowed us to query the backend API from the frontend application with a valid access token. We also updated the backend API to require a valid access token for the `protected` and `admin` endpoints.

In this post, we'll complete the journey by enabling Role-Based Access Controls (RBAC) within Auth0 and restrict access to the `admin` endpoint in our backend API to those users with the correct permissions.

## RBAC and permissions

We start by enabling RBAC within our Auth0 API.

Under the **Settings** tab in the API, switch the **Enable RBAC** and **Add permissions in the Access Token** sliders to the on the setting. Doing so will ensure a `permissions` claim is added to the access token with any scopes that have been assigned to the logged-in user.

A detailed discussion on why scopes should not be used to grant permissions is presented in the post [On The Nature of OAuth2's Scopes](https://auth0.com/blog/on-the-nature-of-oauth2-scopes/). The summary is that a scope constrains the actions that an OAuth client *may* attempt to perform on behalf of a user, but *does not* imply that the user has the permission to access any particular resource.

This has some subtle but significant implications on the claims returned in an Auth0 access token.

Without enabling the RBAC settings, any scope requested by the OAuth client and consented to by the user will be returned in the `scope` claim. It doesn't matter if that scope has been assigned to the user or not - it is returned regardless. It is then the responsibility of the OAuth resource server to allow or deny access to a given resource based on the user's identity and the action being performed.

When RBAC is enabled, only scopes that have been requested by the client, *and* consented to by the user, *and* assigned to a user will be returned in the `scope` claim. In this scenario, the resource server can assume the absence of a scope means the client did not request it, the user did not consent to it, or it has not been assigned to the user, and so can quickly deny access.

By adding the `permissions` claim, each scope assigned to the user is calculated and included in the access token. The `permissions` claim is populated without asking for consent from the user, which supports more traditional RBAC style applications, where clients have delegated all the permissions of their users, and the users don't pick and choose scopes with each login.

Our sample application will make use of the scopes in the `permissions` claim to determine access to the API.

![image_1](https://images.ctfassets.net/23aumh6u8s0i/4ZpaxCFDvKa7It8aToFSBP/06e7bd6600e3146032475a399a0d068a/01_build-a-ktor-api-pt-3.png)
_Enabling RBAC and permissions in the access token._

Under the **Permissions** tab, define a new **Permission (Scope)** of `read:admin-messages` and a **Description** of **The ability to access the admin endpoint**. Click the **Add** button to save the new permission:

![image_2](https://images.ctfassets.net/23aumh6u8s0i/1DJaaadYXA4vGKV9i9R8LK/4564b6449b1b1d190f2345638431b92d/02_build-a-ktor-api-pt-3.png)
_Creating an API permission._

### Creating the role

We now create a role to hold the permissions required by our API. Click the **User Management -> Roles** option and click the **Create Role** button.

In the **New Role** dialog, enter a name of **messages-admin**, enter a description, and click the **Create** button:

![image_3](https://images.ctfassets.net/23aumh6u8s0i/7EQTp4sJS03bScEWno7kEa/a1c2586b32a480c4b166fb4ce5ba09b5/03_build-a-ktor-api-pt-3.png)
_Creating a new role._

Under the **Permissions** tab click the **Add Permissions** button. In the **Add Permissions** dialog select the API we created earlier, select the **read:admin-messages** permission, and click the **Add Permission** button:

![image_4](https://images.ctfassets.net/23aumh6u8s0i/ZBB0FviUiLxmOzXoeDvJV/20ce7562521525551515e16e1c23bbe2/04_build-a-ktor-api-pt-3.png)
_Adding permissions to a role._

### Assigning the role to a user

For the purposes of this demo, I'll assume you have already [created an Auth0 user](https://auth0.com/docs/users/create-users). I'll also assume this user is linked to the application that was created earlier.

[Read more...](https://auth0.com/blog/adding-auth0-rbac-authorization-to-a-ktor-api/?utm_source=content_synd&utm_medium=sc&utm_campaign=kotlin)