In my SPA, I am calling checkSession() method as per the docs, and although it works, the authResult doesn’t contain any of the custom claims/data added by my rules, that i successfully receive on explicit login.
I’ve just checked and the rule using Real-time Webtask Logs and i can see that the rule is in fact firing, and that the correct data is being set in the user object.
However the Id token that is received back from the call does not containing the populated app_metadata and user_metadata claims. These are successfully received within the id_token after an explicit login.
I am using the hosted login page to do the initial authentication along with auth0.js 8.10.1
auth0.authorize() calls the login page.
my checkSession is called …
refreshSession() {
var authInstance =this
this.auth0.checkSession({
audience: 'my audience url',
responseType: 'token id_token',
scope: 'openid profile email api'
}, function (err, authResult) {
console.log(authResult)
authInstance.setSession(authResult)
})
}
and my rule is …
function (user, context, callback) {
user.app_metadata = user.app_metadata || {};
// the user's requested scope
var requested_scopes_string = context.request.query.scope || '';
var requested_scopes = requested_scopes_string.split(' ');
var subscriptionEndOfDays = 3376684800000;
// if the user requested API access, then figure
// out which custom openid connect header to add
if (requested_scopes.indexOf("api") >= 0)
{
if(context.accessToken)
{
//remove any api scopes from scope array
var cleansedArray = requested_scopes.filter(function(item)
{
return item !== "api";
});
requested_scopes = cleansedArray;
}
}
// give admin users 120 years subscription
if (user.app_metadata.isAdmin)
{
user.app_metadata.subscriptionExpiry = subscriptionEndOfDays;
}
//test user has valid subscription set the flag
if(user.app_metadata.subscriptionExpiry && user.app_metadata.subscriptionExpiry > new Date().getTime())
{
user.app_metadata.hasSubscription= true;
requested_scopes.push("api");
}
else
{
user.app_metadata.hasSubscription = false;
}
context.accessToken.scope = requested_scopes;
var namespace = 'https://myhost:eu:auth0:com/';
context.idToken[namespace + 'app_metadata'] = user.app_metadata;
context.idToken[namespace + 'user_metadata'] = user.user_metadata;
callback(null, user, context);
}
Updated my rule to have the following code at the end…
console.log("access token: ");
console.log(context.accessToken);
console.log("id token: ");
console.log(context.idToken);
callback(null, user, context);
which outputs the correct token into the realtime log.
access token:
08:00:16:
{ scope: 'openid', 'profile', 'email', 'api' ] }
id token:
08:00:16:
{ 'https://domain:eu:auth0:com/app_metadata':
{ isAdmin: true,
subscriptionExpiry: 3376684800000,
hasSubscription: true },
'https://domain:eu:auth0:com/user_metadata': {} }
So to summarize, the rule is firing, it appears that the correct context is being prepared and passed to the callback. however when i receive the result via the webAuth.checkSession({}) and log it out to the console. i am getting an access token without the api scope and an id token without the app_metadata claims which are in an OIDC compliant form.