markbates / markbates/goth

auth0: how to get JWT as the Access Token? (aka: how to add things to the AuthURLParam() call)

Open
#239 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
6.6k
Forks
631
PR merge metrics
No merged PRs in 30d

Description

Auth0 can hand out either an opaque Access token, or a JWT. The latter is used to grant access to APIs the user defines.

To do so, it seems to be the case that one must:
- Set the "audience" in the provider to match the API defined in auth0
- Specify API scopes

If you get all of this lined up, auth0 will hand you out a JWT access token. However, there doesn't seem to be support in goth's auth0 provider to handle this case-- I can see the URL is manufacturered in:

```
func (p *Provider) BeginAuth(state string) (goth.Session, error) {
url := p.config.AuthCodeURL(state)
session := &Session{
AuthURL: url,
}
return session, nil
}
```

But AuthCodeURL can take an array of options, too. I seem to need:

```
audience := oauth2.SetAuthURLParam("audience", "my.api")
url := p.config.AuthCodeURL(state, audience)
```

But I can't see how I would override it. Maybe there's a simpler way to upgrade the access token I get into a JWT? If so, I can't work it out. I noticed from scanning the other providers that only gplus seems to have something similar in its SetPrompt() implementation. Would it make more sense to have a more generic version of this?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Auth0 provider's BeginAuth entry point and the config.AuthCodeURL call shown in the issue, then compare option handling in other providers, including gplus's SetPrompt implementation. Determine how audience and API scopes should be supplied and whether the interface should be provider-specific or generic. Done means Auth0 users can request JWT access tokens with those parameters and the behavior is covered by appropriate provider tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.