Custom Claims?

[tHBp]

I'm using Auth0 - Authorization extension and I have configured groups and roles for my application.
After adding users to those groups, I'm not able to access them after authorization. The rule sets groups and roles to user metadata correctly.

Relevant piece of code is here:

app.get("/login", passport.authenticate("auth0", {
        scope: 'openid profile'
    }), function (req, res) {
        // expecting enriched req.user here, but getting basic profile information only
    });

[joshcanhelp]

Anything additional needed in the user profile data that's returned needs to be added as a custom claim.

[aasili-shoprunner]

I didn't want to create a new issue for this question as this seems to be somewhat similar. If not let me know and I'll create one.

I'm in the middle of moving away from the JS SDK for Auth0 to using Passport. In the JS SDK custom params can be passed with authorize() method (at least we found we can). Would these custom claims be added to the acr_values prop instead? Is there a different recommended way to handle this?

[joshcanhelp]

@aasili-shoprunner - Just to clarify ... you're you moving from auth/node-auth0 to Passport?

If you're not already using Passport and you are still in development mode on your application, you might want to consider auth0/express-openid-connect. That's just about to go into Early Access, meaning the public API is mostly stable and we'll be accepting feedback about usability, extensibility, and the like. Just a heads up!

To answer your question ... acr_values is a specific query parameter. At the moment, this strategy does not support arbitrary URL parameters added to the authorize URL. Is there one specifically we're missing support for?

[aasili-shoprunner]

@joshcanhelp No i'm migrating from auth0.js v9 to using passport and passport-auth0. In auth0.js when authorizing the client, arbitrary params can be passed into the options object. Those params can be accessed via a rule in Auth0. I was wondering how to get the same behavior in this package. Thanks!

[joshcanhelp]

At the moment, this strategy does not allow arbitrary URL parameters to be sent to the hosted login page. You can see the parameters that are passed through here:

https://github.com/auth0/passport-auth0/blob/master/lib/index.js#L81-L99

If this is a blocker, go ahead and add a new issue in this repo and we'll consider it for a future release.

[aasili-shoprunner]

Thanks!

It's not a blocker as I can work around it. However do you know why the two libraries differ in this aspect?

[joshcanhelp]

I don't think there is a specific reason one way or the other.