I am having on a tenant the SSO enabled by default. For checking if the user has rights to access my app, I am using Auth0 rule. If an user does not have rights in my rule I throw an unauthorized error via callback. Now everything works fine, however If I try to enter on my app, since SSO is enabled it will see the same user that does not have any rights to acces my app. In my callback component, I treat the case when I receive an unauthorized error type and when I this happens I logout via Auth0JS sdk.
However the same behaviour occurs the and user appears to be remembered so no logout. After looking through the logs I believe that when a rule throws an error the logout api does not see that user existing.
Can someone from Auth0 confirm or infirm this behaviour? Also if someone had this situation, how it was fixed?
Thanks in advance!