React-native-auth0: refreshToken() does not provide an idToken, even when initial webauth response had one

[lukewlms]

I'm unable to get an idToken on refreshing. My initial call to webAuth looks like:

    return await new Auth0({
        clientId: AUTH0_CLIENT_ID,
        domain: AUTH0_DOMAIN,
      })
      .webAuth
      .authorize({
        scope: "openid offline_access",
      });

And yields

{
      "accessToken": "kRqS...",
      "refreshToken": "0_L9y0...",
      "idToken": "eyJ0eXAi...",
      "expiresIn": 86400,
      "tokenType": "Bearer"
    }

But when I try to refresh with this code

  const newCredentials = await auth0
    .auth
    .refreshToken({refreshToken, scope: "openid"});

I get this response (no idToken):

    {
      "accessToken": "prkEy...",
      "expiresIn": 86400,
      "tokenType": "Bearer"
    }

What's happening? The docs say that I should get an idToken if I refresh with the same token I used to initially fetch an idToken. I've also tried explicitly passing openid as part of scope to refreshToken().

(Additionally, expiresIn is ignoring my value of 36000 set in manage.autho.com.)

Thank you.

[lukewlms]

Wow - apparently this is just broken with react-native-auth0. This thread says that it's impossible to refresh and get an idToken if not in OIDC compliant mode. (Of course that would require big changes to the app, signing algorithm, etc.) So we're stuck unless we make a custom call to delegate, which is going to be deprecated.

https://community.auth0.com/questions/1226/how-to-renew-id-token

[lukewlms]

This ended up being pretty straightforward. Set Audience in the webauth call to force OIDC compliance, switch server from HS256 to RS256 and switch the server key to our signing cert.

Now calls to refreshToken are getting an idToken.

[jeanlange]

@lukewlms - Thank you for this clear bug report and followup, even with no one else obviously involved. This helped me, years later. I encourage you to continue doing this sort of good work across the internet.