# Claim set and allowed in policy, but authentication still fails **URL:** \ **Category:** Support\ **Created:** [January 10, 2023, 9:17am UTC](https://discuss.pomerium.com/t/claim-set-and-allowed-in-policy-but-authentication-still-fails/215 "2023-01-10T09:17:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![aadhi0319](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@aadhi0319](https://discuss.pomerium.com/u/aadhi0319)\ **Post date:** [January 10, 2023, 9:17am UTC](https://discuss.pomerium.com/t/claim-set-and-allowed-in-policy-but-authentication-still-fails/215/1 "2023-01-10T09:17:01Z")
## What happened? I am trying to authenticate accesses to `privileged.mysite.com` using Auth0 roles. I am getting a forbidden error from Pomerium upon navigating to that site. I have configured the roles by following the tutorial at `https://www.pomerium.com/docs/identity-providers/auth0#groups`. I can verify that these roles are being added using the /.pomerium endpoint. Note that parts of the image have been redacted. In the following picture, we can see that the user correctly gets the gardener claim. ![screenshot](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/5529128a09b6a816a1fc47e5951825f08d7a778a.jpeg) My policy explicitly allows for users with the gardener group to have access to the site in question. However, I still get a forbidden error when trying to access the site. The relevant access log is as follows: ```auto pomerium-pomerium-1 | {"level":"info","service":"authorize","request-id":"75c7725a-f16b-42be-a9d1-c9164d000b7b","check-request-id":"75c7725a-f16b-42be-a9d1-c9164d000b7b","method":"GET","path":"/","host":"privileged.mysite.com","query":"","ip":"","session-id":"d3df0616-fdef-481d-a57c-9e0a3e2c8db7","allow":false,"allow-why-false":["claim-unauthorized","non-pomerium-route"],"deny":false,"deny-why-false":["valid-client-certificate-or-none-required"],"user":"auth0|634b44b808c244ef54eec1b9","email":"","time":"2023-01-10T07:23:36Z","message":"authorize check"} ``` A seemingly related error: ```auto pomerium-pomerium-1 | {"level":"warn","config_file_source":"/pomerium/config.yaml","bootstrap":true,"service":"identity_manager","error":"auth0: could not list roles: request failed: Get \"https:///api/v2/roles?include_totals=true&page=0&per_page=50\": oauth2: cannot fetch token: 403 Forbidden\nResponse: {\"error\":\"access_denied\",\"error_description\":\"Client is not authorized to access \\\"https:///api/v2/\\\". You need to create a \\\"client-grant\\\" associated to this API. See: https://auth0.com/docs/api/v2#!/Client_Grants/post_client_grants\"}","time":"2023-01-10T08:34:55Z","message":"failed to refresh directory users and groups"} ``` ## What’s your environment like? - Pomerium Docker Container – Latest - Raspberry Pi 3 ## What’s your config.yaml? ```auto # See detailed configuration settings : https://www.pomerium.com/docs/reference/ # this is the domain the identity provider will callback after a user authenticates authenticate_service_url: https://authenticate.gk.aadhithya.cloud #################################################################################### # Certificate settings: https://www.pomerium.com/docs/reference/certificates.html # # The example below assumes a certificate and key file will be mounted to a volume # # available to the Docker image. # #################################################################################### certificate_file: /pomerium/cert.pem certificate_key_file: /pomerium/privkey.pem ################################################################################## # Identity provider settings : https://www.pomerium.com/docs/identity-providers/ # # The keys required in this section vary depending on your IdP. See the # # appropriate docs for your IdP to configure Pomerium accordingly. # ################################################################################## idp_provider: auth0 idp_provider_url: idp_client_id: idp_client_secret: # Generate 256 bit random keys e.g. `head -c32 /dev/urandom | base64` cookie_secret: # Generate keys for JWT verification signing_key: # https://pomerium.com/reference/#routes routes: - from: https://privileged.mysite.com to: https:// policy: - allow: and: - claim/gk/groups: gardener ``` ## Additional context Auth0 Add Group Code ```auto /** * Handler that will be called during the execution of a PostLogin flow. * * @param {Event} event - Details about the user and the context in which they are logging in. * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login. */ exports.onExecutePostLogin = async (event, api) => { if (event.authorization) { api.idToken.setCustomClaim("gk/groups", event.authorization.roles); api.accessToken.setCustomClaim("gk/groups", event.authorization.roles); } }; ``` Any help would be greatly appreciated. Thank you! ---
**Author:** ![denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@denis](https://discuss.pomerium.com/u/denis)\ **Post date:** [January 10, 2023, 4:31pm UTC](https://discuss.pomerium.com/t/claim-set-and-allowed-in-policy-but-authentication-still-fails/215/2 "2023-01-10T16:31:46Z")
you seem to adjust `gk/groups` but the policy is written against `gk/roles`. ---
**Author:** ![aadhi0319](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@aadhi0319](https://discuss.pomerium.com/u/aadhi0319)\ **Post date:** [January 10, 2023, 11:20pm UTC](https://discuss.pomerium.com/t/claim-set-and-allowed-in-policy-but-authentication-still-fails/215/3 "2023-01-10T23:20:59Z")
Thanks for taking a look. Unfortunately, that was a change I made during debugging. I switched it back to `gk/groups` and the issue still persists. I verified that `gk/groups` is being set by auth0 using the /.pomerium endpoint and that is working correctly. I have edited the original question to reflect the updated config file. ---
**Author:** ![denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@denis](https://discuss.pomerium.com/u/denis)\ **Post date:** [January 11, 2023, 6:08am UTC](https://discuss.pomerium.com/t/claim-set-and-allowed-in-policy-but-authentication-still-fails/215/4 "2023-01-11T06:08:53Z")
It is possible that / is converted into \_ Try making a rule for claim/gk\_groups ---
**Author:** ![aadhi0319](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@aadhi0319](https://discuss.pomerium.com/u/aadhi0319)\ **Post date:** [January 11, 2023, 7:19pm UTC](https://discuss.pomerium.com/t/claim-set-and-allowed-in-policy-but-authentication-still-fails/215/5 "2023-01-11T19:19:13Z")
So this is interesting. Changing the rule to claim/gk\_groups did not fix the issue, but changing both the pomerium policy to claim/gk\_groups and the auth0 custom claim to ```auto api.idToken.setCustomClaim("gk_groups", event.authorization.roles); api.accessToken.setCustomClaim("gk_groups", event.authorization.roles); ``` did solve my issue. This solves my problem, but I’m still curious as to how they did it in the Pomerium documentation (linked in this thread) as they use slashes in both auth0 and the pomerium policy. ---
**Author:** ![aadhi0319](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@aadhi0319](https://discuss.pomerium.com/u/aadhi0319)\ **Post date:** [January 11, 2023, 7:54pm UTC](https://discuss.pomerium.com/t/claim-set-and-allowed-in-policy-but-authentication-still-fails/215/6 "2023-01-11T19:54:10Z")
Alright, I figured it out. It seems that on auth0, there’s a new rule where namespaced claims must begin with http or https ([Create Custom Claims](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims)). I formatted my new auth0 custom claim as `https://gk.io/groups` and then was able to use `claim/https://gk.io/groups: gardener` in my Pomerium policy to get a valid authentication. If this is reproducible, the claim in the auth0 documentation should probably be changed from `pomerium.io/groups` to `https://pomerium.io/groups`. Thanks for your help @denis!