Update of documentation on auth0 settings ?

[wkulesza]

Can you please update the AUTH0 part of documentation. Auth0.com web panel has changed and it's difficult to set auth0 correctly, as the provided settings in the documentation are different. Also, does a server without ssl work correctly with auth0 and datatools ?

[wkulesza]

Upon configuration of Auth0, when trying to follow the datatools docs: Application is Machine to Machine Token Endpoint Authentication Method set to Basic (when setting to None the error doesn't show up - but still, i cant import any gtfs - testing on) Application Login URI set to http://www.my_domain:9091/login Allowed Callback URLs set to http://www.my_domain:9091/login, http://www.my_domain:9091/ Allowed Logout URLs, Allowed Web Origins, Allowed Origins (CORS) set to http://www.my_domain:9091/ in advanced, tab OAuth JSON Web Token (JWT) Signature Algorithm set to HS256 (tried RS256) Cross-Origin Verification Fallback set to https://www.my_domain:9091/ (i don't have ssl set in that docker nginx)

Rules set accordingly from datatools docs:

function (user, context, callback) {
    var namespace = 'http://datatools/';
    if (context.idToken && user.user_metadata) {
      context.idToken[namespace + 'user_metadata'] = user.user_metadata;
    }
    if (context.idToken && user.app_metadata) {
      context.idToken[namespace + 'app_metadata'] = user.app_metadata;
    }
  callback(null, user, context);
}

and users set too (with grants checked boxes for Implicit, Authorisation Code, Refresh token, Password. I might be missing Scope, but where do i set it ?

pem file was downloaded too(both from the url provided in docs and also from Certificates tab in Advanced user settings. AUTH0_DOMAIN, AUTH0_CLIENT_ID and AUTH0_PUBLIC_KEY are configured correctly too.

in logs of auth0 website, i'm getting (replaced real client id with foo, userid with userfoo and user_name with auth0 email user and company_name.auth0.com )

{
  "date": "2021-04-20T17:36:45.474Z",
  "type": "scoa",
  "connection": "Username-Password-Authentication",
  "connection_id": "con_2ujQe3tjeWNd1Ph7",
  "client_id": "foo",
  "client_name": "DataToolsNew",
  "ip": "109.173.168.40",
  "user_agent": "Chrome 90.0.4430 / Windows 10.0.0",
  "details": {
    "prompts": [
      {
        "name": "coverify",
        "session": true,
        "stats": {
          "loginsCount": 48
        },
        "connection": "Username-Password-Authentication",
        "timers": {
          "rules": 132
        },
        "elapsedTime": null
      }
    ],
    "completedAt": 1618940205473,
    "elapsedTime": null,
    "stats": {
      "loginsCount": 48
    }
  },
  "hostname": "company_name.auth0.com",
  "user_id": "userfoo",
  "user_name": "auth0 email user",
  "auth0_client": {
    "name": "lock.js",
    "version": "11.27.1",
    "env": {
      "auth0.js": "9.13.4",
      "auth0.js-ulp": "9.13.4"
    }
  },
  "log_id": "90020210420173648423215393272429991418913574660926865506",
  "_id": "90020210420173648423215393272429991418913574660926865506",
  "isMobile": false,
  "description": "Successful cross-origin authentication"
}

Datatools webpage (after successfull ? login) shows: Warning! Could not verify user's token

And in the network tab of admin tools in chrome (Chrome 90.0.4430) i'm getting following responses: for recentactivity, project, jobs:

{"result":"ERR","message":"Could not verify user's token","code":401,"detail":null}

and for appinfo:

{"repoUrl":"https://github.com/ibi-group/datatools-server.git","commit":"47371e0578cc7ad2cac876c882df665e5c7088d0","config":{"application":{"assets_bucket":"datatools-staging","public_url":"http://fooaddress","notifications_enabled":false,"port":4000,"data":{"mapdb":"/tmp","gtfs":"/tmp","editor_mapdb":"/tmp","regions":"/tmp","use_s3_storage":false,"s3_region":"us-east-1","aws_role":"arn:aws:iam::${AWS_ACCOUNT_NUMBER}:role/${AWS_ROLE_NAME}","gtfs_s3_bucket":"bucket-name"}},"modules":{"validator":{"enabled":false},"deployment":{"enabled":true},"enterprise":{"enabled":false},"editor":{"enabled":true},"user_admin":{"enabled":true},"r5_network":{"enabled":false},"gtfsapi":{"enabled":false,"load_on_fetch":false,"load_on_startup":false,"use_extension":"xyz"}},"extensions":{"transitland":{"enabled":false,"api":"https://transit.land/api/v1/feeds"},"transitfeeds":{"enabled":false,"api":"https://api.transitfeeds.com/v1/getFeeds","key":"${TRANSITFEEDS_API_KEY}"}}}}

and userinfo:

{"nickname":"wojciech","name":"wojciech","picture":"https://s.gravatar.com/avatar/667c3a7534352640af90129366f7f09c?s=480&r=pg&d=https%3A%2F%2Fcdn.auth0.com%2Favatars%2Fwo.png","updated_at":"2021-04-20T11:26:44.294Z","email":"auth0 email user","email_verified":true,"sub":"auth0|607d4b987bb43a006b5ef736","http://datatools/user_metadata":{},"http://datatools/app_metadata":{"datatools":[{"permissions":[{"type":"administer-application"}],"subscriptions":[],"projects":[],"client_id":"3NE9Xw86zu35F6UdnQx4pFQERkVdtoD5"}]}}

[landonreed]

There appears to be an active outage of Auth0 right now: https://status.auth0.com/incidents/zvjzyc7912g5?u=v0zzz6jxvbv7

This may be contributing to the errors you're seeing.

[wkulesza]

@landonreed you can close it down, but updating documentaton on configuration following the new auth0 web interface would be handy. Important is to add that this has to be Machine to Machine application and Token Endpoint Authentication Method has to be set to None.

[jaredcowoCS]

@wkulesza How were you able to make the project work with 0Auth? I am currently following the docs but to no avail.