Auth0.js: get auth0 user metadata as part of user information

[ghost]

I don't find how to get the user_metadata from the Auth0 Authentication api:
Here is the code I wrote:

var auth0WebAuth = new auth0.WebAuth({
clientID: process.env.AUTH0_CLIENT_ID,
domain: process.env.AUTH0_DOMAIN,
});
....

return new Promise(function (resolve, reject) {
auth0WebAuth.client.login({
username: username,
password: password,
realm: 'Username-Password-Authentication',
scope: 'openid profile'
}, (err, authResult) => {
if(err) {
reject(err);
} else{
if (authResult && authResult.accessToken && authResult.idToken) {
setToken(authResult.accessToken, authResult.idToken);
auth0WebAuth.client.userInfo(authResult.accessToken, (error, profile) => {
if (error) {
console.log('Error loading the Profile', error);
} else {
setProfile(profile);
resolve(authResult);
}
});
}
}
});
});

This code returns profile ,but it does not contain all of the usermetadata.
This is the result.
{
"sub":"auth0|XXXX",
"name":"[email protected]",
"nickname":"XXXX",
"picture":"XXXX.png",
"updated_at":"2017-03-31T08:50:59.819Z",
"email":"[email protected]",
"email_verified":true
}

I tried this with postman and at that time it works well.
Postman returns:
{
"email": "[email protected]",
"email_verified": false,
"user_id": "auth0|xxx",
"clientID": "xx",
"picture": "https://s.gravatar.com/avatar/768xxx
"nickname": "xxx",
"identities": [
{
"user_id": "xxx",
"provider": "auth0",
"connection": "Username-Password-Authentication",
"isSocial": false
}
],
"updated_at": "2017-05-16T09:22:09.981Z",
"created_at": "2017-05-06T07:39:57.177Z",
"user_metadata": {
"sn": [
"000000002cfbbf3c"
],
"phone_number": "xxx",
"gender": "Male",
"username": "xxx",
"location": "xxx",
"post": "xxx",
"note": "Please add note here",
"name": "xx",
"email": "xxx"
},
"name": "xxx",
"app_metadata": {},
"sub": "auth0|xxx"
}

How is it supposed to work?

[dorilla]

try adding user_metadata to the scope

[BrunoQuaresma]

Not works to me. 😢

[dorilla]

do you happen to have OIDC Conformant turned on for your Client?

[BrunoQuaresma]

Where do I find this?

[davidascher]

I have a similar problem, using v8, w/o OIDC Conformance. None of the new attributes in the scope end up encoded in the JWT.

[cmddavid]

Same problem here, i post with: { scope: "openid app_metadata" } but in the response it overrides the scope with something like this: { scope: "openid profile email" }. And as a result, i don't get the app_metadata i need.

[hzalaz]

Let me clarify something first, we recommend using auth0.js v8 if you need to use API Auth features (as stated in the README) which means that you cannot request metadata via the scopes (I will add a stronger notice in the README later so its more evident).

If you are relying on requesting them via scopes you have two choices, use v7 and forget about v8 until you are forced to migrate or migrate to v8 and change how you request the metadata depending on what methods in auth0.js you use (We will remove in the future non OAuth/OIDC compatible methods to make this evident)

If you use authorize you can ask for metadata in the scopes as long as you don't use our API Auth feature (by passing an audience parameter) or have your Auth0 client marked as OIDC conforment in its settings (via Dashboard or API).

The same applies to the following methods:

• http://auth0.github.io/auth0.js/docs/global.html#loginWithResourceOwner
• http://auth0.github.io/auth0.js/docs/global.html#loginWithCredentials
• http://auth0.github.io/auth0.js/docs/global.html#signupAndLogin

In the case you are not in any of the previous cases you would need to request the metadata in a different way. This can be achieved by using a rule to add custom claims to either id_token or access_token as described in this doc.

Also the scopes in the response are the ones granted to the AuthZ request which could be different from the originally requested so that's expected and by design.

[cmddavid]

Thank you @hzalaz for explaining, i used a rule to add a custom claim as following:

function (user, context, callback) {
  var namespace = 'https://yourdomainname.com/';
  context.idToken[namespace + 'app_metadata'] = user.app_metadata;
  context.idToken[namespace + 'user_metadata'] = user.user_metadata;
  //context.accessToken[namespace + 'app_metadata'] = user.app_metadata;
  //context.accessToken[namespace + 'user_metadata'] = user.user_metadata;
  callback(null, user, context);
}

This seems to be working well 👍

[manyanic]

It worked for me as well.

However, after using client.login, I had to use getUserInfo to get the app_metadata.

[b4dnewz]

For me with a non-OIDC client by adding app_metadataor user_metadata on the scope it's not working, there's something to set in the WebAuth client?

[ptsteadman]

Storing authorization extension app_metadata in the id token is unideal for us because we will likely have a decent amount of different permissions, and the token could become too large. The authorization extension documentation references a token info endpoint, does this exist?

[luisrudge]

@ptsteadman if you can call another endpoint, just fetch the user info directly:

auth0.client.userInfo(authResult.accessToken, function(err, user) {
    // Now you have the user's information
  });

[luisrudge]

We recommend using the auth0.client.method when you can. If you absolutely need to have inside the id_token, you'll have to use a rule to do that.

[mrdonado]

@BrunoQuaresma in order to activate/deactivate the OIDC Conformant flag, you can click on:

Clients->Advanced Settings (scroll down)->OAuth->OIDC Conformant

I deactivated it by the way, and when I use the following rule:

function (user, context, callback) {
  var namespace = 'http://localhost:8761/';
  context.idToken[namespace + 'app_metadata'] = user.app_metadata;
  context.idToken[namespace + 'user_metadata'] = user.user_metadata;
  //context.accessToken['app_metadata'] = user.app_metadata;
  //context.accessToken['user_metadata'] = user.user_metadata;
  context.idToken['app_metadata'] = user.app_metadata;
  context.idToken['user_metadata'] = user.user_metadata;
  callback(null, user, context);
}

I get back the fields with namespace (e.g.: http://localhost:8761/user_metadata), but not those with only app_metadata and user_metadata. I tried with accessToken too, but that gives no metadata back.

[bennypowers]

I have the same situation as @fjrd84
from a development perspective, it would be easier to get back app_metadata instead of the prefixed http://namespace.app/app_metadata

[jacobkuriala]

I used the rule strategy and am facing the same situation as @fjrd84 and @bennypowers . Seems like a hacky way of doing this. If i dont include the namespace then the metadata does not come as part of the response to userinfo call.

[mrdonado]

@bennypowers @jacobkuriala apparently, so that it works without a namespace prefix, you need an older auth0 account. Newer accounts don't allow that altogether. Older accounts have a migrations section like this under user/tenant settings -> advanced -> migrations, where all (or at least some) of the options must be activated:

Newer accounts don't even show such options.

[rocky1138]

Is there a document that describes how to easily access this information via AngularJS Auth0? I just want to get the metadata included in my getProfile request. Is that difficult to do?

[luisrudge]

@rocky1138 the docs are here: https://auth0.com/docs/api-auth/tutorials/adoption/scope-custom-claims - you add the claims to the idToken and use that

[jacobbroughton]

There really should be a more intuitive way of doing this, seems careless to just omit user_metadata from the default response.

[oliverjanik]

The issue with custom claims is that I'm not in control of Auth0 dashboard, our customers are.