Organization ID in Tokens using the Resource Owner Password Grant Flow

Overview

This article explains if it is possible to get an organization ID or its name as a claim in an ID Token or an Access Token with the Resource Owner Password Grant (ROPG) flow.

Applies To
  • Organizations
  • ROPG Flow
  • Actions
  • Tokens
Cause

The tokens returned from the ROPG flow do not inherently return an org_id as one of the limitations of organizations is that organizations-enabled applications are not compatible with some of our grants, including ROPG as described in the following Auth0 Documentation: Limitations.

Solution

Although organizations are not supported, it is still possible to have an organization ID be present in tokens by setting one as a custom claim using actions.

  • However, in this case there would be nothing in the 'event' object of the action that would display an organization ID.
  • Therefore, if an organization ID is required, perhaps for browserless testing, it would have to either be set as a static value or depending on other attributes.

NOTE: "org_id" and "org_name" are subject to Auth0's general restrictions on claims, so any custom usage of these would need to be namespaced to avoid collisions and being ignored.

Recommended content

No recommended content found...