Groups Claim Is Not Added to Token When Using Authorization Extension

This article addresses the requirement to pass a "groups" claim in tokens when using the Authorization Extension. It explains why the claim might be missing and provides the necessary configuration steps to include it.

• Authorization Extension
• JSON Web Tokens (JWT)

The "groups" claim is a restricted claim name. Additionally, the Authorization Extension adds data to the user object but does not add data directly to tokens.

1. Ensure the claim is namespaced, as "groups" is a restricted claim name. Any attempts to add this claim to tokens without a namespace are ignored.

   • Create Custom Claims - General Restrictions

2. Use an Action to add a namespaced "groups" claim to the token. This claim can be based on the user's app_metadata.

   • NOTE: The Authorization Extension historically added claims directly to tokens, but this is no longer the case. It is recommended to use the Authorization Core feature instead of the extension where possible.

   • Authorization extension groups not in JWT