Implicit grant custom domain: identitity provider login returns auth0 domain iss

Help
, ,
1

I am in the process of switching to a custom domain for our SPA with implicit grant authorization method, using auth0-js v9.7.2. Authentication on auth0 domain works fine with username/password as well as identity providers. However when using the custom domain it seems that the token issuer value differs when attempting to login via an identity provider, so username/password still works, but via identity provider I get the following error:

{error: “invalid_token”, errorDescription: “Issuer https://mydomain.eu.auth0.com/ is not valid.”}

Explicitly setting the token issuer by adding __token_issuer: ‘https://mydomain.eu.auth0.com/’ as an option resolves the issue for authentication via identity provider, but then introduces a similar error for username/password authentication stating:

{error: “invalid_token”, errorDescription: “Issuer https://login.mydomain.com/ is not valid.”}

Due to this, I can not get both authentication methods functioning via a custom domain at the same time. The document on Custom Domains states that the iss claim should always be the domain via which the request was done, but this does not appear to be the case here.

2 Likes
2

Hello, I’m having the exact same problem. Did you find a solution?

2 Likes
3

Hey there!

Sorry for such huge delay in response! We’re doing our best in providing you with best developer support experience out there, but sometimes our bandwidth is not enough comparing to the number of incoming questions.

Wanted to reach out to know if you still require further assistance?

4

Hi @lucasdchamps and @konrad.sopala, we eventually figured this out: in order for this to work, we resolved this by configuring the Google social connection with our own credentials. By default the Google social connection uses auth0 default development credentials, but these do not seem to work for some reason in an implicit grant authorization with a custom domain, if you want simultaneously username/password and social login.

This doesn’t seem to be stated anywhere in the documentation, took us quite a while to figure it out.

1 Like
5

Gotchya! Thanks a lot for providing that feedback, will relay it to appropriate team and get it implemented!