Why is it necessary to pass the 'audience' parameter to receive a JWT?

sgmeyer · May 8, 2018, 10:11am

Hi @wr8tt5 as @luis.rudge mentioned we use the audience parameter to make a determination which resource server the user is authorizing access to. By default auth0 issues that opaque token which has limited use on some of our API endpoints. We also issues that opaque access_token when specifying the /userinfo endpoint as the audience.

In our implementation we require you to specify an audience for some resource server. This indicates to Auth0 that we are using an OIDC flow and the audience of that token will be for the specified resource server. Many libraries often include a way to specify audience or other custom parameters natively via a property or in this case via extra parameters. Here is the code I think you will might be able to use (it assumes you are using Universal Login / hosted login page):

github.com

IdentityModel/IdentityModel.OidcClient/blob/14bbbb00c74d7069e7213f1d5eb12a9b8c2786c2/src/IdentityModel.OidcClient/AuthorizeClient.cs#L111


      
                  CodeVerifier = pkce.CodeVerifier,
              };
          
          
    state.StartUrl = CreateAuthorizeUrl(state.State, state.Nonce, pkce.CodeChallenge, extraParameters);
          
          
    _logger.LogDebug(LogSerializer.Serialize(state));
          
          
    return state;
          }
          
          
internal string CreateAuthorizeUrl(string state, string nonce, string codeChallenge, object extraParameters)
          {
              _logger.LogTrace("CreateAuthorizeUrl");
          
          
    var parameters = CreateAuthorizeParameters(state, nonce, codeChallenge, extraParameters);
              var request = new RequestUrl(_options.ProviderInformation.AuthorizeEndpoint);
          
          
    return request.Create(parameters);
          }
          
          
internal string CreateEndSessionUrl(string endpoint, LogoutRequest request)

If you didn’t want to specify the audience parameter as part of the authorize call you can optionally specify the default audience for your tenant. Doing this means all clients will get a JWT access token for the default resource server without specifying an audience. To setup a default audience you can:

Navigate here: https://manage.auth0.com/#/tenant
Enter a default audience:

Topic		Replies	Views
Implicit access_token Opegue, not JWT? OIDC Enabled Help	3	3871	December 4, 2018
Accesstoken and Id-Token. Which one to use and how to validate an opaque accesstoken? Help	2	3142	August 28, 2019
Opaque access token introspection Help access_token , opaque-tokens , api-access_token	3	7355	March 2, 2018
Authentication with SPA and API Help jwt , auth0	2	4043	September 17, 2020
createAuth0Client ignores passed in Audience. Generates JWT with audience of access_token Help angular , jwt , auth0 , spa , auth0-spa-js	4	4438	March 4, 2020

Why is it necessary to pass the 'audience' parameter to receive a JWT?

Related topics