title: Auth0 - Rules & Groups && User Management
body: <p>I have created an account with Auth0 and I am trying to get a simple login for Angular 2 to our backend API.</p>
  <h1>1. What I am trying to do is to be able to access the roles in the API to see whether the user has the correct permissions.</h1>
  <p>I have enabled the Auth0 Authorization extension I have gone in and created one group and one role, I have assigned these to a test user which I have created, I have then gone to the configuration and published the rules for token contents and persistence.</p>
  <p>How can I view the permissions/groups from the JWT in an nodejs app? I am using <code>express-jwt</code> and this:</p>
  <pre><code>const authenticate = jwt({
    secret: config.get('AUTH0_CLIENT_SECRET'),
    audience: config.get('AUTH0_CLIENT_ID'),
    credentialsRequired: false,
  });
  </code></pre>
  <p>Which is giving me details such as iss, sub, aud. But no details on the user metadata, how am I able to retrieve this? Also as I have clearly not used Auth0 before, is it best practice to store the user details on our own databases also so I can use my own ID to store against the user actions, or is it possible to use an ID if Auth0 give one to store against user actions in our database.</p>
  <p><strong>EDIT 1</strong></p>
  <p>Ok I can see there is an options parameter for the Lock which you can pass scopes in, is it bad practice to request these when logging in? There will only really be a handful of groups/roles for now. Or is better that the API can lookup the user using the token provided to get the app_metadata to view the permissions etc, if so how can I look this up?</p>
  <hr />
  <h1>2. How am I able to manage the users and view them so I can display them in our own admin panel and manage the permissions they have.</h1>