Cannot update user email or password

Help
1

Hi ho. I’m trying to implement custom flow on mobile app for the user to update his email / password.

This is my auth code on iOS:

Auth0
.authentication()
.login(
        usernameOrEmail: authData.email,
        password: authData.password,
        realm: Constants.emailConnection,
        audience: "user-update",
        scope: Constants.scope,
        parameters: nil
    )
    .start { [weak self] result in
        switch result {
        case .success(let credentials):
            _ = self?.credentialsManager.store(credentials: credentials)
            completionHandler(.success(result: credentials))
        case .failure(let error):
            completionHandler(.failure(error: error))
        }
    }

And this is how I try to update the user data:

 Auth0
 .users(token: accessToken)
 .patch(userInfo.sub, attributes: attributes)
 .start { result in
      switch result {
      case .success:
           completionHandler(.success(result: {}()))
      case .failure(let error):
           completionHandler(.failure(error: error))
      }
 }

The error I get when calling above method:

Fail: Failed with unknown error [“statusCode”: 401, “message”: Bad audience: user-update https://folt.auth0.com/userinfo, “error”: Unauthorized]

I’m lost… can’t figure out why I still getting that error. Any help?

2

Hey @michal!

I guess you need to make one change in your code. Instead of using accessToken you need to go for idToken.

Let me know if that worked :slight_smile:

3

Hi Konrad :slight_smile:
I’ve tried using idToken but I get another error then:

Fail: Failed with unknown error ["statusCode": 401, "attributes": {
    error = "Invalid token";
}, "message": Invalid token, "error": Unauthorized]
4

That’s quite strange. Let me get back to you once I confirm it with our iOS SDK team!

1 Like
6

Ok so there’s actually one more thing that I overlooked.

  • To edit Metadata you need to specify audience as: https://your_auth0_domain/api/v2/
  • As a Public client what you can edit is also restricted. You can not change an email address

If you want greater control you need to be using a confidential client type such as a Webapp or M2M that has full access to the Management API so basically use backend and get a Management API token to update the user (here’s the list of fields that are “updateable / non-updateable”: Normalized User Profile Schema

7

Thanks @konrad.sopala. Did move the logic to the backend which manages management API. Works fine now.

Cheers,
M.

1 Like
8

Glad you made it work!

9

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.