-
Notifications
You must be signed in to change notification settings - Fork 90
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[BUG][DOCS] Integrate Auth0 as an Authentication Provider #543
Comments
Thank you @gander for reporting this issue! Looking at the documentation that you linked, it seems that none of the claims that are mentioned in the tutorial are listed as restricted claims, but I see that there is a restricted token audience section that mentions that non-namespaced claims are removed when the target is an Auth0 API, which is the case when following the tutorial. I don't believe that was the case previously, so I will review this and update the documentation 👍 |
This PR surrealdb/surrealdb#4061 will solve the requirement to set a full namespace for custom claims., e.g. Full working example: surrealdb/surrealdb#4058 (comment) |
For now we have decided to update the documentation to accurately reflect the current behavior. We have also updated the Auth0 tutorial to reference the restricted claims and the requirement to use a namespace prefix. Thank you for the report! |
When I used this example, Auth0 required me to communicate https even for testing. I don't know if it's just me, but that's the only reason I sent it to Cloudflare Pages, unknowingly adding to CORS configuration issues. Give it to someone to test, preferably with different environments (win, lin, mac) so that it is always true. |
By the way, you can explain that SurrealDB CREATE is protected against cheating, i.e. I authorize myself with a token but I try to create another account, it won't work because |
Description
It concerns article "Integrate Auth0 as an Authentication Provider", from which I also used example "SurrealDB Auth0 Authentication Example" to make sure I did the entire process correctly.
The article provides an example of the Auth0 action code to implement: "Creating a custom Auth0 action to add claims for SurrealDB"
The problem is that the private custom claims are not added to the payload (Migrate Custom Claims: Restricted claims), so they are not delivered to SurrealDB, and there is still an authorization problem.
After a few days of experimenting, I found in the "Using Tokens" documentation that I could add the
https://surrealdb.com/
namespace.This now works properly.
Fixed action code:
I think a note like this would be useful:
Is there an existing issue for this?
Code of Conduct
The text was updated successfully, but these errors were encountered: