The current implementation of the OAuth2 flow for Auth0 does not support custom domains since Auth0 requires the audience parameter to always be set to the default tenant domain name (see Auth0 APIs).
A small code change to add an additional parameter to the Auth0 config should allow this to work as expected. Constructing the audience domain from a new audience_domain config key in the authorize method of the Auth0SignIn class should fix this issue. If no audience_domain is specified, the config will gracefully fall back to consumer_domain.
In docassemble/docassemble_webapp/docassemble/webapp/server.py:
def authorize(self):
if 'oauth' in daconfig and 'auth0' in daconfig['oauth'] and daconfig['oauth']['auth0'].get('enable', True) and self.consumer_domain is None:
raise DAException("To use Auth0, you need to set your domain in the configuration.")
try:
audience_domain = daconfig['oauth']['auth0']['audience_domain']
except (KeyError, TypeError):
audience_domain = self.consumer_domain
audience = 'https://' + str(audience_domain) + '/userinfo'
return redirect(self.service.get_authorize_url(
response_type='code',
scope='openid profile email',
audience=audience,
redirect_uri=self.get_callback_url())
)
In docassemble/docassemble_base/config.yml:
auth0:
enable: False
id: ceyd6imTYxTNmuj2CYpwH_cEhdWt93e6
secret: LLGEBDrrgDFDfBsFjErsdSdsntkrtAbfa4ee3ss_adfdSDFEWEsfgHTerjNsd3dD
domain: auth.example.com
# audience_domain: example.auth0.com # Optional: should be the default tenant domain (i.e. example.auth0.com) if you use a custom domain in Auth0
In docassemble/Docker/config/config.yml.dist:
auth0:
enable: False
id: ceyd6imTYxTNmuj2CYpwH_cEhdWt93e6
secret: LLGEBDrrgDFDfBsFjErsdSdsntkrtAbfa4ee3ss_adfdSDFEWEsfgHTerjNsd3dD
domain: auth.example.com
# audience_domain: example.auth0.com # Optional: should be the default tenant domain (i.e. example.auth0.com) if you use a custom domain in Auth0
I would be happy to create a PR with the change + associated documentation for the new config key if desired.
The current implementation of the OAuth2 flow for Auth0 does not support custom domains since Auth0 requires the audience parameter to always be set to the default tenant domain name (see Auth0 APIs).
A small code change to add an additional parameter to the Auth0 config should allow this to work as expected. Constructing the audience domain from a new
audience_domainconfig key in theauthorizemethod of theAuth0SignInclass should fix this issue. If noaudience_domainis specified, the config will gracefully fall back toconsumer_domain.In
docassemble/docassemble_webapp/docassemble/webapp/server.py:In
docassemble/docassemble_base/config.yml:In
docassemble/Docker/config/config.yml.dist:I would be happy to create a PR with the change + associated documentation for the new config key if desired.