Simply getting a JWT in exchange for a user/pass

[dan.woda]

Hi @Civility,

Thanks for putting together that write up. It is super helpful for users looking for the same solution, and is something we appreciate greatly. I added links to it in the two topics you mentioned, hopefully we can move those out of the SEO spotlight and move this topic into it.

Let’s talk about the comments from the first thread you linked:

How to obtain user JWT token from username/password?

My feeling is that Auth0 has become a really confusing, messy and over complicated solution. Also, this change was a major change to the workflow and it has not been communicated properly.

How to obtain user JWT token from username/password?

I agree. Auth0 looks and feels painfully over-architected, without simple solutions to common workflows.

This is something that we talk about internally constantly. Finding a balance between a robust, enterprise solution that provides the scalability and extensibility required by large customers; and a simple, intuitive, and efficient solution for builders that want to get up and running ASAP, so they can focus on what matters to them.

Even further, we provide a security product. Some of our features (like the resource owner password grant) can be misused. This is why there are so many warnings and caveats about doing something as seemingly simple as exchanging a credential for a token. We steer customers (particularly ones who want a one-click solution) towards quickstarts and Universal Login.

Any specific feedback you have on how we can further drive that vision forward is always appreciated.

I’ll try and address some of the other feedback you mention regarding the Community:

@Civility

Closed topics just because no answer was given…

We don’t have an automatic closure for unanswered topics any longer. We did this for a period of time but have since stopped closing topics that have no responses.

@Civility

• feel frustrating to those who could give an answer later
• make it awkward to notify users in those topics if starting a new topic with the solution

Simply linking the OP will notify the user of your topic.

@Civility

starting a new thread just to say “Here’s a solution to this old thread” feels clunky and creates clutter in the forum

Old topics often get derailed. For example, the first one you posted very quickly went from a technical question about ROPG to a critique of the general state of Auth0. It is not productive for that topic, and should be a discussion started in a new thread or submitted to our feedback page if appropriate.

In my ideal world, all similar questions would exist in the same thread, but this just simply doesn’t happen. Thread are constantly hijacked as a way to get more eyes on a question by sending out notifications to all users. Dealing with many short threads is much easier than a few less threads with no clear focus.

@Civility

search engines will still direct users to the old topics, without solutions, and those users won’t find the solution given later ( IF the user who bothers to start a new thread (the vast majority won’t) links to the old topic, there will be a tiny link at the bottom of the old topic pointing to the new one, but that’s very easy to miss, and doesn’t suggest there’s a solution now; just a related topic)

• this can easily make users think Auth0 has a limitation, when in fact that was fixed later

We will consider this feedback in our team weekly meeting.

Thanks again for all of the feedback. We appreciate the time you took to go through it.

Best,
Dan