Auth0 Roles Missing in Action Event During Account Linking

During an account linking transaction with a federated account, Auth0 fails to populate roles that belong to a database account in the event.authorization.roles array. This occurs because the event reflects the original logging-in identity rather than the primary account. Fetching the primary user roles directly from the Management API and appending them as custom claims to the tokens within the post-login Action resolves this issue.

• Auth0
• Post-Login Actions
• Account Linking

This is intended product behavior. During the account linking transaction, the event.authorization.roles array and the in-Action role helpers reflect the original logging-in identity (the federated account). Therefore, the roles that belong to the primary database account do not appear in the event until subsequent logins.

How are the primary user roles fetched and appended as custom claims?

The primary user's roles can be fetched directly from the Management API and appended as custom claims to the tokens within the Post-Login Action.

1. After the account link and setPrimaryUser() step complete, fetch the primary user's roles from the Management API using the GET /api/v2/users/{id}/roles endpoint with the primary user's user_id.
2. Set the returned role names onto the ID token, Access token, or both as a namespaced custom claim (for example, https://<namespace>/roles).

NOTE: Auth0 silently drops non-namespaced custom claims.