First of all, thank you, Srinath. The way you explain each IAM concept with a demo is really good and very easy to follow. After the Authentication vs Authorization and RBAC lessons, the Auth0 example you showed in the video gave me the idea to build my own version the same way. Here is what I did: 1. I Set up my app in Auth0 as a Single Page Application. 2. After that, I made two users, one admin and one normal user. 3. Made two roles (admin and user) and assigned them to the users. 4. Added a Post-Login Action so each user's role goes into their login token. 5. Built a small app with four pages (Public, Profile, Protected, Admin) that checks the role. Result: both users can log in (authentication), but only the admin can open the Admin page. The normal user logs in fine but gets a clear "Access Denied" (authorization). This proves: being logged in is not the same as being allowed to access everything.

Interesting one. Done with the OAuth 2.0 M2M lab with Auth0. I executed the Client Credentials flow and decoded the access token. Here is an extra step, in case you experience the same problem: please you need to turn on RBAC on the API and give the app the permission before read:invoices show in the token. If you do not, the permissions list comes back empty. Please check the screenshot for more clarity. Just for your References: Enable Role-Based Access Control for APIs : https://auth0.com/docs/get-started/apis/enable-role-based-access-control-for-apis Adding RBAC Permissions to Access Tokens : https://support.auth0.com/center/s/article/Adding-RBAC-Permissions-to-Access-Tokens

Implemented full OpenID Connect flow with Auth0, decoded the ID Token (JWT), and identified the sub, iss, and email claims.

Lucas in and James out