How to properly sign in with universal login and organizations

[brandon.fleming]

I’m trying to get Universal login working with organizations. I’ve verified that the organization is set up correctly and that my user account has been granted access to the org. I’ve also verified that the organization name I’m passing matches the correct org I wish to access.

I’m using @auth0/auth0-react@2.2.4.

const AuthProvider = ({ children }) => {
  const navigate = useNavigate()

  const onRedirectCallback = (appState) => {
    navigate(appState?.returnTo || window.location.pathname)
  }

  return (
    <Auth0Provider
      authorizationParams={{
        organization: getOrgId(window.location.hostname) // retrieves the organization name from the subdomain of the hostname
        redirect_uri: window.location.origin,
      }}
      clientId={import.meta.env.VITE_AUTH_CLIENT_ID}
      domain={import.meta.env.VITE_AUTH_DOMAIN}
      onRedirectCallback={onRedirectCallback}
    >
      {children}
    </Auth0Provider>
  )
}

The documentation for the authorizationParams.organization property states that I can use the organization name:

/**
     * The organization to log in to.
     *
     * This will specify an `organization` parameter in your user's login request.
     *
     * - If you provide an Organization ID (a string with the prefix `org_`), it will be validated against the `org_id` claim of your user's ID Token. The validation is case-sensitive.
     * - If you provide an Organization Name (a string *without* the prefix `org_`), it will be validated against the `org_name` claim of your user's ID Token. The validation is case-insensitive.
     *
     */
    organization?: string;

When redirecting the user to the Universal Login page via loginWithRedirect, I’m immediately redirected back my applications login page and I can see two query string values:

error=invalid_request
error_description=authorization request parameter organization must be an organization id

This contradicts the documentation for the AuthProvider. What am I doing wrong?

[rueben.tiow]

Hi @brandon.fleming,

Welcome to the Auth0 Community!

The documentation for the AuthProvider is correct. The organization can be specified using either the org_id or org_name.

However, in this context, you must provide the org_id in your login request to log in with organizations.

The AuthorizationParams Interface might also be used in another context like silent authentication, where the user is already authenticated and you are revalidating the session. In this scenario, you could check the org_name claim in the ID token.

Thanks,
Rueben