Skip to content

Support for custom domains on Auth0 #863

Description

@nbently

The current implementation of the OAuth2 flow for Auth0 does not support custom domains since Auth0 requires the audience parameter to always be set to the default tenant domain name (see Auth0 APIs).

A small code change to add an additional parameter to the Auth0 config should allow this to work as expected. Constructing the audience domain from a new audience_domain config key in the authorize method of the Auth0SignIn class should fix this issue. If no audience_domain is specified, the config will gracefully fall back to consumer_domain.

In docassemble/docassemble_webapp/docassemble/webapp/server.py:

    def authorize(self):
        if 'oauth' in daconfig and 'auth0' in daconfig['oauth'] and daconfig['oauth']['auth0'].get('enable', True) and self.consumer_domain is None:
            raise DAException("To use Auth0, you need to set your domain in the configuration.")
        try:
            audience_domain = daconfig['oauth']['auth0']['audience_domain']
        except (KeyError, TypeError):
            audience_domain = self.consumer_domain
        audience = 'https://' + str(audience_domain) + '/userinfo'
        return redirect(self.service.get_authorize_url(
            response_type='code',
            scope='openid profile email',
            audience=audience,
            redirect_uri=self.get_callback_url())
        )

In docassemble/docassemble_base/config.yml:

  auth0:
    enable: False
    id: ceyd6imTYxTNmuj2CYpwH_cEhdWt93e6
    secret: LLGEBDrrgDFDfBsFjErsdSdsntkrtAbfa4ee3ss_adfdSDFEWEsfgHTerjNsd3dD
    domain: auth.example.com
    # audience_domain: example.auth0.com  # Optional: should be the default tenant domain (i.e. example.auth0.com) if you use a custom domain in Auth0

In docassemble/Docker/config/config.yml.dist:

  auth0:
    enable: False
    id: ceyd6imTYxTNmuj2CYpwH_cEhdWt93e6
    secret: LLGEBDrrgDFDfBsFjErsdSdsntkrtAbfa4ee3ss_adfdSDFEWEsfgHTerjNsd3dD
    domain: auth.example.com
    # audience_domain: example.auth0.com  # Optional: should be the default tenant domain (i.e. example.auth0.com) if you use a custom domain in Auth0

I would be happy to create a PR with the change + associated documentation for the new config key if desired.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions