Unable to access email inside accessToken

dorinclisu / fastapi-auth0

FastAPI authentication and authorization using auth0.com

MIT License

230 stars 39 forks source link

Unable to access email inside accessToken #9

Closed OzturkAlperen closed 3 years ago

OzturkAlperen commented 3 years ago

I am unable to access email using accessToken

Steps I have done:

Set 'Add email to access token' rule from Auth0 dashboard:

function addEmailToAccessToken(user, context, callback) {
var namespace = 'namespace';
context.accessToken[namespace + 'email'] = user.email;
return callback(null, user, context);
}

Set 'openid profile email' permission for API

Set environment variable to matching namespace:

os.environ["AUTH0_RULE_NAMESPACE"] = "namespace"

Sign out and sign back in from SPA frontend to renew accessToken

I have also tried adding passing 'openid profile email' to route and Auth0 scopes to see if makes any difference at all. It didn't

auth.get_user still returns email=None

What am I doing wrong? Thanks in advance.

dorinclisu commented 3 years ago

Auth0 does not allow arbitrary strings for the namespace, it expects a URL starting with http:// or https://. This is a best practice enforced by auth0 servers, though not well documented.

That is the reason the library default is the url of this repo ;)

And btw, do not forget that namespace and "email" should be separated by "/" in the javascript function.

OzturkAlperen commented 3 years ago

Thanks, got it. Let me try that.

Also i want to include user_metadata in the accessToken as well. I have created a rule already. Where should i start tweaking your package? I would be so glad if you can direct me a bit. Thanks in advance.

dorinclisu commented 3 years ago

You do not need to tweak the package, as custom user models are supprted since PR https://github.com/dorinclisu/fastapi-auth0/pull/3

Assuming the metadata is just a string, this is how you would do it:

class CustomAuth0User(Auth0User):
    meta: Optional[str] = Field(None, alias='https://your_namespace/user_metadata')

auth = Auth0(domain=..., api_audience=..., auth0user_model=CustomAuth0User)

@app.get('/secure')
async def get_secure(user: CustomAuth0User = Security(auth.get_user)):
    ...

If it's a json, you should define a sub-model for the metadata accordingly.

OzturkAlperen commented 3 years ago

Got it, thanks again. I have successfully included both email and the user metadata in accessToken.