Configure sign up and log in with Auth0 using the OAuth2 Basic Plugin

[blake (Blake Erickson)]

@shahidmir

1- Im guessing once ive logged in to discourse successfully via oauth2 plugin, after logging out when i retry a login, the auth0 lock widget remembers the user and offers option to login by just clicking email address link. This process fails as no json is returned, and im assuming the correct scopes are not being passed to the auth0 end point, though those scopes are defined inside discourse? (FIXED - seems to work now, using the scopes specified in the oauth2 plugin scope config. Only issue i have seen is that the json is now restricted to just the ID, and not the email nor other details, only in the silent case).

Is this still an issue? I know your edit says fixed, but then you say there is another issue and I don’t understand what that is?

Either way, once I got everything working again creating a user with an already logged in auth0 user works just fine:

@shahidmir

2- On successful authentication, a popup box appears in discourse asking user to choose/change nickname and username. Can this be bypassed?

Not that I’m aware of using oauth. This is most likely possible using sso though.

@shahidmir I’m not sure if you are still having any other issues with auth0, but if you are please just post them in this topic. Thanks!

[shahidmir (shahid)]

Hi blake
It is not working exactly as it is for you.

1- When i login to discourse and enter the username/password, auth0 authentication completes fine and populates the “create account” screen in discourse.

2- second scenario: new account in auth0 created. User then logs into web app, then comes to login to discourse (so discourse record not yet created). The auth0 login box pops up with the credentials pre-populated. Accept these credentials, auth0 authenticates and sends user back to the “create account” screen in discourse, but none of the fields are pre-populated.
Looking at the discourse logs, the json from the /userinfo endpoint is coming back empty in this scenario.

[blake (Blake Erickson)]

@shahidmir

It is not working exactly as it is for you.

This means something somewhere isn’t configured correctly, my first guess is in the auth0 dashboard somewhere. Can you tell me what your settings are for your application under “Advanced Settings” → “OAuth”?

I think you may need to turn off “OIDC Conformant”.

[leog (Leo Giovanetti)]

Hi @shahidmir,
I didn’t have this problem, Auth0 always considered the user being logged in on my use cases, and it is still working fine right now.

@shahidmir

So when I login to discourse via this method, then immediately go off to another area of my web application (not discourse, that also requires login via Auth0)

I’m pretty sure you can’t expect the user to be logged in a different area as you mention. Take a look at this thread.

[shahidmir (shahid)]

Hi @leog, thanks for the link, will check it out now…

Just to give u more detail:

1. My webapp is running in aws under domain ‘http://mydomain.com’.
2. Discourse is also hosted in aws under same domain, but served through cloudfront, using different path ie. “http://mydomain.com/discourse-forum”.

WORKING SCENARIO

1. Click login on “http://mydomain.com”. Lock widget opens up with no credentials. Enter credential and all good, logged in.
2. Now go to discourse by changing url to “http://mydomain.com/discourse-forum”. Clock login and lock widget opens up with credentials pre-populated because of step 1.

NOT WORKING SCENARIO

1. Click login on “http://mydomain.com/discourse-forum”". Lock widget opens up with no credentials. Enter credential and all good, logged in.
2. Now go to webapp by changing url to “http://mydomain.com/”. Click login and lock widget opens up again with NO credentials because according to auth0 step 1 did not complete due to redirect, hence no user login record.

Will take a look at the link you provided, thanks.

PS: In auth0, I am using:

• single tenant
• single API as audience
• one client application for login to http://mydomain.com
• separate client application for login to http://mydomain.com/discourse-forum
• After successful authentication, it is an auth0 rule which sends client back to either “http://mydomain.com” or to “http://mydomain.com/discourse-forum” depending on the calling client id.

[RCheesley (Ruth Cheesley)]

I have a query on this from a UX perspective.

When a user clicks to sign up using the Auth0 (set up as the OAuth2 method) account, and authenticate or create an account, they are dropped back to the Discourse ‘create account’ form - and a user is created successfully in Auth0. The password field is hidden on the create account form, but no other fields are pre-populated.

I’d expect that the fields such as email and name would be pre-populated as the user in Auth0 has these fields available.

I’m not sure if I am missing something, but it is a pretty bumpy user experience and could be error prone (e.g. which email gets notifications, the Auth0 user account or the email they enter on the new user form?).

Ruth

[blake (Blake Erickson)]

Hi Ruth, thanks for posting your question, I moved it to this topic to keep things in one place.

I’d expect that the fields such as email and name would be pre-populated as the user in Auth0 has these fields available.

If everything is setup correctly those fields will be pre-populated. So now we need to figure out what might be different with your current setup.

Can you to into your Auth0 application settings and then “Advanced Settings” → “OAuth” and turn off “OIDC Conformant” and see if that helps?

[RCheesley (Ruth Cheesley)]

Can you to into your Auth0 application settings and then “Advanced Settings” → “OAuth” and turn off “OIDC Conformant” and see if that helps?

Just tried that, saved changes and when I log in with Auth0, the user is created in Auth0 but fields are still not being populated. Thanks for the suggestion!

Ruth

[RCheesley (Ruth Cheesley)]

I moved it to this topic to keep things in one place.

Seems like this thread seems to be deprecated, I never found it before, hence why the discussions were elsewhere! This would have saved me a lot of time so thanks for flagging it up!

[Serginho_Cintra]

Hi @blake,

I did all the steps but I having two kind of problems:

1. I can do the Auth0 authentication but it’s not copying user information to Discourse Dialog Window to create a new user. I have to write all the information on user creation.

2. If I create a new user as I told in step 1, it’s receiving the email and user of the last user that was created. It’s sounds very weird.

If you have a tip to fix it or if I am doing something wrong, please let me know.

Thanks, Sergio

[blake (Blake Erickson)]

@Serginho_Cintra

but it’s not copying user information to Discourse Dialog Window to create a new user.

This usually means something somewhere isn’t quite hooked up right. Can you verify these settings are correct in your auth0 settings?

@blake

Can you tell me what your settings are for your application under “Advanced Settings” → “OAuth”?

@blake

I think you may need to turn off “OIDC Conformant”.

Please provide any other settings you have configured in auth0 so I can help debug.

[Serginho_Cintra]

isn’t quite hooked up right

I looked now and “OIDC Conformant” is turned off.

[Serginho_Cintra]

My configuration:

[Serginho_Cintra]

[Serginho_Cintra]

All the new users are authenticated in Auth0 and at Auth0’s log everything is fine. But the information is not copied to create a new user in Discourse.

[blake (Blake Erickson)]

On the Discourse side can you remove “oauth2 json username path” , “oauth2 json name path”, and “oauth2 json avatar path” for now. Then can you update “oauth2 json email path” to “email”. Let’s see if we can just get that working, then we can work on the other fields.

Also you can check “oauth2 email verified” because auth0 is already verifying the email addresses.

[Serginho_Cintra]

Thanks for your return but unfortunately I am still stuck on it. I also create a new Auth0 account, just for text and the problem continuos. Is there a log where I can track this information?

[blake (Blake Erickson)]

Have you been to /logs on your forum? If you have the debug oauth setting turned on your should be able to see some entries from auth0.

[Serginho_Cintra]

Yes, I tried to authenticate and I found 3 log entries:

Message

OAuth2 Debugging: after_authenticate response:

creds: {"token"=>"42mopR4vXo5Tl-FzNxJn6S6umkL2W4Sh", "expires_at"=>1532128992, "expires"=>true} info: {"id"=>nil, "name"=>nil} extra: {}

Message (6 copies reported)

OAuth2 Debugging: user_json_url: GET https://xulapa.eu.auth0.com/userinfo

Message (13 copies reported)

OAuth2 Debugging: user_json: {"sub"=>"google-oauth2|100582788655510862666"}

[blake (Blake Erickson)]

Auth0 should still send the user info whether you use google to auth or auth0 directly. But can you try and log in directly with auth0 username and pass instead of google and see what that sends to Discourse in the payload.

The json returned now looks something like this with an identities array:

{
        "email": "test@example.com",
        "user_id": "auth0|123456789",
        "identities":[{
                "user_id": "123456789",
                "provider": "auth0",
                "connection": "Username-Password-Authentication",
                "isSocial": false
        }]
}

Your json should look something like above.

I have this working at https://discourse-test-prod-box.blakeerickson.com/ you can also try google auth via auth0 and see if it works there.