App that requires access to my users' Auth0 Tenant Management API v2

harshilmattoo · December 21, 2023, 8:40pm

Hello,

I’m building an application that requires read:users access to my user’s Auth0 management api. What would be the best approach to the user to consent to provide this access and therefore grant me an Access (+Refresh?) token to execute this?

slcredentialmanager · December 22, 2023, 9:15am

I’m not sure about your setup, so I don’t really understand why you would need a user’s permission to read their user info. If this is your own user, you should be able to just read their info through the /userinfo route. If it is some other user, they will not be able to authorize access to the management API by design; that API is meant for managing users and is restricted to authorized users.

If this is some user outside of your tenant that you want to get their information from, I think this is a use case for SSO; being able to authenticate and authorize with another Identity Provider. Because otherwise, you can’t just pass user information as plaintext, the JWT is encrypted and will not tell you anything.

As an aside, see here to learn how to get a Management API Access Token.

harshilmattoo · December 22, 2023, 3:11pm

It’s the owner of the Auth0 tenant – its so that I can run analysis on their users tables. What I really need is a way to get the production bearer token (as outlined in these steps: Get Management API Access Tokens for Production) but through a web app interface. It doesn’t sound like them posting client secrets into a web page is very secure.

tyf · December 22, 2023, 10:58pm

Hey @harshilmattoo !

Correct! In general, we recommend proxying requests through a backend if possible. While you can get a Management API access token in a SPA, the scopes/permissions are rather limited by design. Here’s a simple example using the node-auth0 ManagementClient:

github.com

tyfrth/auth0-react-samples-proxy/blob/d12c61173852fabe743d7b5b9f417b81799442a6/Sample-01/api-server.js#L56


      
            audience: authConfig.audience,
            issuerBaseURL: `https://${authConfig.domain}/`,
            algorithms: ["RS256"],
          });
          
          //validate access token
          app.get("/api/external", checkJwt, (req, res) => {
            res.json({ message: `Hello ${req.auth.payload.sub}, your access token was successfully validated!` });
          });
          
          //proxy request to Management API to change user's nickname
          app.post('/api/external/nickname', checkJwt, (req, res) => {
          
            const data = JSON.stringify(req.body)
            console.log(data); 
            
            auth0.users.update({id: req.auth.payload.sub}, data, function (err, user) {
              if (err) {
                console.log(err)
                res.json({message: `Unable to successfully set new nickname! - Check tenant logs for possible errors`})
              } else {