I am sure this is easy to everyone else. But I have searched for weeks and only get close to a solution, but nothing that completes the suggested implementation. I am hoping to use a Post Login Action and redirect to an OWIN Web API that connects to the legacy system and produces a code that system can understand. I want the trigger to report an error if the code cannot be generated which means that the user profile is not mapped in the legacy system.
This is the code I have in the Post Login trigger code:
exports.onExecutePostLogin = async (event, api) => {
// If the user has already been assigned a TempLoginCode
// if( event.user.app_metadata.TempLoginCode ) {
// return;
// }
// api.user.setAppMetadata(“TempLoginCode”, “HaveValue”);
const token = api.redirect.encodeToken({
secret: event.secrets.MY_SHARED_SECRET,
payload: {
email: event.user.email,
},
});
api.redirect.sendUserTo( “http://l/account/enrichment”, {
query: { session_data: token }
});
};
exports.onContinuePostLogin = async (event, api) => {
//api.user.setUserMetadata(“FixTempCode”, “Fix2Value”);
//api.user.setAppMetadata(“FixAppCode”, “FixAppValue”);
try {
const payload = api.redirect.validateToken( {
secret: event.secrets.MY_SHARED_SECRET,
tokenParameterName: ‘session_token’,
});
// api.user.setAppMetadata(“claimCode”,
// payload.session_token.Subject.claims[“clmCode”]);
// api.user.setAppMetadata(“NewTempCode”, payload.claims[“NewTempCode”]);
// api.user.setAppMetadata(“FixSecondCode”, event.request.query.newtempcode);
} catch(e) {
console.log(“Error:”, e);
}
};
After days of searching, I found some sample web api MVP Code in which I am able to catch the call from Auth0. Written using .net version 4.6, this code is:
public ActionResult Enrichment( string state, string session_data )
{
try
{
var tokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidIssuer = “MYDOMAIN.us.auth0.com”,
ValidateAudience = false,
ValidateLifetime = true,
IssuerSigningKey = new SymmetricSecurityKey( Encoding.UTF8.GetBytes( MySecretValue ) ),
ClockSkew = TimeSpan.Zero
};
var handler = new JwtSecurityTokenHandler();
var jsonToken = handler.ReadToken( session_data ) as JwtSecurityToken;
if( jsonToken == null )
throw new SecurityTokenException( "Invalid JWT token" );
//string emAddr = jsonToken.Claims.Where( emClaim => emClaim.Type == "email" ).First().Value;
//This area will be enhanced to communicate with the legacy system and
// produce a code to be returned
var tokenDescriptor = new SecurityTokenDescriptor
{
Issuer = jsonToken.Issuer,
Expires = jsonToken.ValidTo,
SigningCredentials = new SigningCredentials( new SymmetricSecurityKey(
Encoding.UTF8.GetBytes( MySecretValue ) ),
SecurityAlgorithms.HmacSha256 ),
Subject = new ClaimsIdentity( new[]
{
new Claim("state", state),
new Claim("sub", jsonToken.Subject),
new Claim("clmCode","ANewValue")
} )
};
var token = handler.CreateToken( tokenDescriptor );
return View( "Redirect", new RedirectViewModel
{
State = state,
SessionToken = handler.WriteToken( token ),
NewTempCode = "SimpleTest"
} );
}
catch( Exception ex )
{
// Handle exception
// Console.WriteLine( ex );
throw new Exception( "Token could not be decoded", ex );
}
}
the view code
@using global::SampleTwo.Models
@model RedirectViewModel
Loading...
;You can see my commented code in the trigger code for onContinuePostLogin. You can also see that I have tried passing information in the claim collection, on the query string, and in the payload.
So - I face the following failures:
- How do I properly send the code back to the trigger? Claim? Query? Payload? Other?
- What do I do in the trigger so that my Angular front-end can see it for the calls that already work with a direct login connection against the legacy system? (Note - in my angular, I can use the User object - but not UserMetadata, AppMetadata, nor claims.
- I can’t even see how to find the console log used in the /continue effort as it might have additional clues fo rme.
Obviously, I am new to most of this, but have searched a long time. I can’t even find, a second time, the code for my web api so I am happy this part connects to Auth0 currently. Many blurbs refer to .net core which I cannot use yet. Almost every example I find simply assumes that these pieces are so easy that there needs to be no example. Unfortunately, that is not true for me and I simply cannot progress.
I would be most grateful for links to complete code samples or directions I can follow to make this work.
This is kind of throwing me too, because it sounds like you want to provision a user in an app that is accepting your Auth0 tenant as the source of identity. In certain cases: “…we have some contracts where the customer wants us to permit the Auth0 login from a certain client to create an account if it didn’t already exist.”