auth0/auth0-java

Java client library for the Auth0 platform

Note As part of our ongoing commitment to best security practices, we have rotated the signing keys used to sign previous releases of this SDK. As a result, new patch builds have been released using the new signing key. Please upgrade at your earliest convenience.

While this change won't affect most developers, if you have implemented a dependency signature validation step in your build process, you may notice a warning that past releases can't be verified. This is expected, and a result of the key rotation process. Updating to the latest version will resolve this for you.

📚 Documentation - 🚀 Getting Started - 💻 API Reference 💬 Feedback

Documentation

• Examples - code samples for common auth0-java scenarios.
• Migration Guide - guidance for updating your application to use version 2 of auth0-java.
• Docs site - explore our docs site and learn more about Auth0.

Getting Started

Requirements

Java 8 or above.

auth0-java is intended for server-side JVM applications. Android applications should use the Auth0.Android SDK.

Installation

Add the dependency via Maven:

<dependency>
  <groupId>com.auth0</groupId>
  <artifactId>auth0</artifactId>
  <version>2.11.0</version>
</dependency>

or Gradle:

implementation 'com.auth0:auth0:2.11.0'

Configure the SDK

Authentication API Client

The Authentication API client is based on the Auth0 Authentication API.

Create an AuthAPI instance by providing the Application details from the dashboard.

AuthAPI auth = AuthAPI.newBuilder("{YOUR_DOMAIN}", "{YOUR_CLIENT_ID}", "{YOUR_CLIENT_SECRET}").build();

Management API Client

The Management API client is based on the Management API Docs.

Create a ManagementAPI instance by providing the domain from the Application dashboard and a valid API Token.

ManagementAPI mgmt = ManagementAPI.newBuilder("{YOUR_DOMAIN}", "{YOUR_API_TOKEN}").build();

The Management API is organized by entities represented by the Auth0 Management API objects.

User user = mgmt.users().get("auth0|user-id", new UserFilter()).execute().getBody();
Role role = mgmt.roles().get("role-id").execute().getBody();

You can use the Authentication API to obtain a token for a previously authorized Application:

AuthAPI authAPI = AuthAPI.newBuilder("{YOUR_DOMAIN}", "{YOUR_CLIENT_ID}", "{YOUR_CLIENT_SECRET}").build();
TokenRequest tokenRequest = authAPI.requestToken("https://{YOUR_DOMAIN}/api/v2/");
TokenHolder holder = tokenRequest.execute().getBody();
String accessToken = holder.getAccessToken();
ManagementAPI mgmt = ManagementAPI.newBuilder("{YOUR_DOMAIN}", accessToken).build();

An expired token for an existing ManagementAPI instance can be replaced by calling the setApiToken method with the new token.

See the Auth0 Management API documentation for more information on how to obtain API Tokens.

API Reference

• AuthAPI
• ManagementAPI

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

• Auth0's general contribution guidelines
• Auth0's code of conduct guidelines

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public Github issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

---

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.

auth0-java's Issues

Reset password method doesn't throw an exception when a wrong emailAddress is passed

When an email address is passed which does not belong to any user, failed log is generated but an exception is not thrown. But in general behavior when using the login method if email or password is wrong, an exception is thrown, So I was excepting a similar behavior,
Please guide me if I am on the wrong track.

Feature request: ability to introspect management API User connection

Though the connection is in memory if I've fetched a user, there's no way to actually read the field unless I dump it to JSON. Is there a reason for this design choice?

auth0-java/src/main/java/com/auth0/json/mgmt/users/User.java

Line 516 in 5f44c0d

String getConnection() {

Create API token

The only way to create a new API token is through a http request?
and how do you verify that API token isn't expired?

Feature request: add support for the /delegation API

I'd like to use this SDK to obtain an access_token for a refresh_token - it looks like in Auth0 this is done with the /delegation API. Is it possible to add that to the Java SDK so I don't have to roll my own implementation? Thanks!

Feature Request: Allow sending client ip as `auth0-forwarded-for` header for password grant

As required in this https://auth0.com/docs/api-auth/tutorials/using-resource-owner-password-from-server-side#brute-force-protection-and-server-side-apis

Upgrade to OkHttp3

Since OkHttp3 is released for a while.
Would you consider upgrade to OkHttp 3?

query for search users is not correctly translated

Hi,

I had a query "user_metadata.*environmentType:"DEMO""

This query works in the Management test api

Call failed with sdk because url creation

Web management api send :: user_metadata.%5C*environmentType%3A%22DEMO%22

Your sdk send :: user_metadata.\*environmentType:%22DEMO%22

Best regards

Support for POST /api/v2/jobs/users-exports

Since we're now unable to query the management api to find users based on our own internal ID we're forced to create our own local cache of user accounts; the Auth0 recommended way to do this is to use the export job method on the management API however this doesn't appear to be supported by the Java API.

We need at least support for:

• https://auth0.com/docs/api/management/v2#!/Jobs/post_users_exports
• https://auth0.com/docs/api/management/v2#!/Jobs/get_results

Improve support for PKCE flow

It would be nice if this library would better support the PKCE flow. Specifically:

• Allow instantiating AuthAPI without a client secret.
• Library functions for creating the code_verifier and code_challenge as documented in the Java sample code here.
• Add a withCodeChallenge method to AuthorizeUrlBuilder (perhaps withParameter("code_challenge_method", "S256") could be called automatically when using withCodeChallenge).
• Add a method to the AuthAPI class that additionally sets the code_verifier parameter, e.g.:

  public AuthRequest exchangeCodeWithVerifier(
      String code, String redirectUri, String codeVerifier)

1.0.1 release

Would it be possible to have updated version released? Custom properties handling is critical for me and it's not in 1.0.0 but exists in the source code for two months already.

Update of name, familyName, givenName fails with API v2, and should be @deprecated

The User class contains these, but they are not supported, with the API returning a message suggesting to use user_metadata instead.

They should be at least deprecated in the Javadoc so that developers know that they should migrate away from using them.

NullPointerException, StdDeserializer

Using 'com.auth0:auth0:1.3.0'
java 1.8.0_111

Failing Test:

import org.junit.Test;

import com.auth0.client.mgmt.ManagementAPI;
import com.auth0.client.mgmt.filter.UserFilter;
import com.auth0.exception.Auth0Exception;
import com.auth0.json.mgmt.users.UsersPage;
import com.auth0.net.Request;

public class Auth0Test {
    @Test
    public void auth0DoesNotFail() throws Auth0Exception {
        ManagementAPI managementApi = new ManagementAPI("jivecake.auth0.com", "TOKEN_OBSCURED");
        UserFilter filter = new UserFilter();
        filter.withQuery("email:\"[email protected]\"");

        Request<UsersPage> request = managementApi.users().list(filter);
        request.execute().getItems();
    }
}

Stack trace:

java.lang.NullPointerException
	at com.fasterxml.jackson.databind.deser.std.StdDeserializer.<init>(StdDeserializer.java:66)
	at com.auth0.json.mgmt.users.UsersPageDeserializer.<init>(UsersPageDeserializer.java:18)
	at com.auth0.json.mgmt.users.UsersPageDeserializer.<init>(UsersPageDeserializer.java:22)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
	at com.fasterxml.jackson.databind.util.ClassUtil.createInstance(ClassUtil.java:556)
	at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.deserializerInstance(DefaultDeserializationContext.java:229)
	at com.fasterxml.jackson.databind.deser.DeserializerCache.findDeserializerFromAnnotation(DeserializerCache.java:427)
	at com.fasterxml.jackson.databind.deser.DeserializerCache._createDeserializer(DeserializerCache.java:326)
	at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCache2(DeserializerCache.java:264)
	at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCacheValueDeserializer(DeserializerCache.java:244)
	at com.fasterxml.jackson.databind.deser.DeserializerCache.findValueDeserializer(DeserializerCache.java:142)
	at com.fasterxml.jackson.databind.DeserializationContext.findRootValueDeserializer(DeserializationContext.java:477)
	at com.fasterxml.jackson.databind.ObjectMapper._findRootDeserializer(ObjectMapper.java:4179)
	at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3997)
	at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3011)
	at com.auth0.net.CustomRequest.parseResponse(CustomRequest.java:62)
	at com.auth0.net.BaseRequest.execute(BaseRequest.java:37)
	at Auth0Test.auth0DoesNotFail(Auth0Test.java:17)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
	at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:86)
	at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:459)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:678)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:382)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:192)

Update username Or password using management API

I'm trying to update a existing Users' username and password with this method https://github.com/auth0/auth0-java#update

But getting a APIException and the exception description says:

Additional properties not allowed: identities,updated_at,created_at,family_name,given_name,nickname,name,picture,user_id 
(consider storing them in app_metadata or user_metadata. See "Users Metadata" in https://auth0.com/docs/api/v2/changes for more details)

I've followed this thread : https://auth0.com/forum/t/apiv2-payload-validation-error/372/4 , where someone named 'yenkel' said

"I'll track this so we can add support to modify this fields in the near future, only for users that have been created in a database connection (not from any other IdP)."

that thread is old , did they implemented it , please let me know
Question: how can I update a the username and password of existing user profile, Or how can I update that user profile ?

Thanks in advance :)

OkHttpClient - A connection to [issuer] was leaked

Hi,

We're using com.auth0:auth0:1.0.0 and com.auth0:auth0-spring-security-api:1.0.0-rc2 inside a spring-boot 1.5.1.RELEASE application. When calling the Auth0 API, we occasionally see a log warning that apparently emanates from okhttp3:

2017-02-27T08:05:05.453 WARN  okhttp3.OkHttpClient - A connection to https://[our-issuer-id].auth0.com/ was leaked. Did you forget to close a response body? To see where this was allocated, set the OkHttpClient logger level to FINE: Logger.getLogger(OkHttpClient.class.getName()).setLevel(Level.FINE);

Looking it up it seems the possible cause is that the body of the request needs to be explicitly closed when the response code is not 200. See square/okhttp#2311.

Thanks!

Issue accessing management.user().list().

Hi, @lbalmaceda

I am facing one issue while accessing user's list with some parameter. I can run it from the console but facing the issue in the sdk. Here I am attaching my code with the error message. Any help on this will be appreciated. Thanks in advance.

Code:

public boolean isExistingEmail(String email){
    UserFilter filter = new UserFilter();
    filter.withFields("email", true);
    String primary = "email:".concat("\"").concat(email).concat("\"");    
    try {
      logger.info("Speciment email payload: {}", primary);
      filter.withQuery(primary);
      //filter.withQuery();
    } catch (UnsupportedEncodingException e) {
      // TODO Auto-generated catch block
      e.printStackTrace();
      return false;
    }
    logger.info("Speciment payload: {}", filter);
    Request<UsersPage> request = mgmt.users().list(filter);
    try {
        UsersPage response = request.execute();
        this.emailPresentStatus = response;
    } catch (APIException exception) {
        api error
        return false;
    } catch (Auth0Exception exception) {
        request error
      return false;
    }
    if(this.emailPresentStatus.getTotal() > 0){
      logger.info("Response while checking for email present or not {}", this.emailPresentStatus.getItems());
      return true;
    }
    return false;
}

Error:

ERROR   [2017-08-15 13:48:01,488] io.dropwizard.jersey.errors.LoggingExceptionMapper Error handling a request: 109c717ab1a127e9java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.ObjectMapper.readerFor(Lcom/fasterxml/jackson/databind/JavaType;)Lcom/fasterxml/jackson/databind/ObjectReader;
	at com.auth0.json.mgmt.users.UsersPageDeserializer.getArrayElements(UsersPageDeserializer.java:52) ~[auth0-1.1.0.jar:na]
	at com.auth0.json.mgmt.users.UsersPageDeserializer.deserialize(UsersPageDeserializer.java:30) ~[auth0-1.1.0.jar:na]
	at com.auth0.json.mgmt.users.UsersPageDeserializer.deserialize(UsersPageDeserializer.java:15) ~[auth0-1.1.0.jar:na]
	at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3562) ~[jackson-databind-2.5.1.jar:2.5.1]
	at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2597) ~[jackson-databind-2.5.1.jar:2.5.1]
	at com.auth0.net.CustomRequest.parseResponse(CustomRequest.java:62) ~[auth0-1.1.0.jar:na]
	at com.auth0.net.BaseRequest.execute(BaseRequest.java:37) ~[auth0-1.1.0.jar:na]

Rename project to auth0-java

Management API - user creation with id specified

Hi,

In Auth0 management API, user creation call, there is a possibility to specify particular user_id.
I can't find a way do set it via the client here, since User class id field doesn't have a setter.

Any way to work around this besides implementing POST call by hand?

Managing Signup and Login using Oauth 2 Accesstoken

Hi @lbalmaceda

First of all thanks for this SDK. Now I can manage regular login and signup with the help of this plugin. But I couldn't able find suitable apis which handle the social Signup and login using Oauth 2 Token. I have a custom login page in my front end which gives Oauth 2 token on successful login in social media like google and facebook. So I want to use this tokens for signing up and login of my users. Can you please guide me to implement this?

Thanks in advance.

HTTP response status in exception

How to get a response status in case of error response? Auth0Exception is just an IOException, no information about reason - it's critical to know if it's 403, or 404 (or anything else).

Support for http proxy

Looking at the code there is no way to set up an http proxy for AuthAPI to use. Would like to be able to set proxy (URL or host/port) on the AuthAPI object. The code I was reviewing is in AuthAPI constructor:

         client = new OkHttpClient.Builder()
                .addInterceptor(logging)
                .addInterceptor(telemetry)
                .build();

Please let me know if I'm missing something here. Thanks!

.

Provide tokeninfo method

I've just migrate from 0.4 to 1.0 and I'm missing the AuthenticationAPIClient#tokenInfo(idToken) method.

I'm using lock with JWT for my single page application. I call my API passing the JWT as Authentication header. I then use the JWT to retrieve the user info by calling #tokenInfo.

With the new 1.0 version, I have not find the #tokenInfo method which is documented here https://auth0.com/docs/api/authentication?http#get-token-info
I've only found AuthAPI#userInfo but it requires an access_token.

Is it possible to add such #tokenInfo method in AuthAPI ? Or is there a new way to handle that situation ?

Identity lacks access_token_secret

The Twitter identity provides both an access_token and access_token_secret in its Identity. Both of these values are necessary when doing third-party auth with Twitter. Unfortunately, the current Identity class only provides the access_token field. Preferably, another field would be added for access_token_secret.

Latest version 1.0.0 is not in the centeral respository

http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22com.auth0%22%20AND%20a%3A%22auth0%22

no setter for User.id

for testing purposes it would be helpful if there was some way other than using jackson to magically set the userId field for an auth0 User object.

SignUp response is a VoidRequest

Currently the signUp call returns a VoidRequest even though the documentation specifies the server responds with a message like

{
  "_id": "58457fe6b27...",
  "email_verified": false,
  "email": "[email protected]"
}

It would be better for signUp to return something like CustomRequest<User> so the newly created user id can be accessed.

How to request Auth0 to resend the verification email, via Java API?

I did not find any way to resend the validation email with Java API.

Also following method is not available via Java API.
https://auth0.com/docs/api/management/v2#!/Jobs/post_verification_email

When will this be made available as a Maven dependency?

Or JCenter or wherever so I can pull it in using Gradle.

Socket Timeout Exception while a user with large metadata attempts to login

I'm using the v1.3.0 and when I try to authenticate a user with large meta data then the following exception show up, the OkHttpClient of AuthAPI has a private getter so was not able set read timeout , pls have a look at following code and stack tress , any suggestion is welcome , pls suggest me how can I solve this

Code:

public boolean authenticate(String strEmail,String strPass) {
    AuthAPI auth = new AuthAPI(domain, client_id,client_secret);
    AuthRequest request = auth.login(strEmail, strPass,auth0UserDBConnection);
            try{
                holder = request.execute();
            }catch(Auth0Exception e){
                e.printStackTrace();
                //System.out.println("Auth0 Exception::");
            } catch(Exception ex){
                ex.printStackTrace();
                //System.out.println("Exception::"+ex.getMessage());
            }
}

Exception:

 com.auth0.exception.Auth0Exception: Failed to execute request
	at com.auth0.net.BaseRequest.execute(BaseRequest.java:34)
	at com.test.security.Auth0Service.authenticate(Auth0Service.java:210)
	at com.test.g.LoginLayout.handleLogin(LoginLayout.java:313)
	at com.test.g.LoginLayout$1.buttonClick(LoginLayout.java:246)
	at sun.reflect.GeneratedMethodAccessor618.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.__invoke(DelegatingMethodAccessorImpl.java:43)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at com.vaadin.event.ListenerMethod.receiveEvent(ListenerMethod.java:510)
	at com.vaadin.event.EventRouter.fireEvent(EventRouter.java:200)
	at com.vaadin.event.EventRouter.fireEvent(EventRouter.java:163)
	at com.vaadin.server.AbstractClientConnector.fireEvent(AbstractClientConnector.java:1015)
	at com.vaadin.ui.Button.fireClick(Button.java:377)
	at com.vaadin.ui.Button$1.click(Button.java:54)
	at sun.reflect.GeneratedMethodAccessor617.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.__invoke(DelegatingMethodAccessorImpl.java:43)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at com.vaadin.server.ServerRpcManager.applyInvocation(ServerRpcManager.java:158)
	at com.vaadin.server.ServerRpcManager.applyInvocation(ServerRpcManager.java:119)
	at org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.run(AbstractThreadPool.java:571)
Caused by: java.net.SocketTimeoutException: Read timed out
	at java.net.SocketInputStream.socketRead0(SocketInputStream.java)
	at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
	at java.net.SocketInputStream.read(SocketInputStream.java:170)
	at java.net.SocketInputStream.read(SocketInputStream.java:141)
	at sun.security.ssl.InputRecord.readFully(InputRecord.java:465)
	at sun.security.ssl.InputRecord.read(InputRecord.java:503)
	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
	at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:930)
	at sun.security.ssl.AppInputStream.read(AppInputStream.java:105)
	at okio.Okio$2.read(Okio.java:138)
	at okio.AsyncTimeout$2.read(AsyncTimeout.java:236)
	at okio.RealBufferedSource.indexOf(RealBufferedSource.java:344)
	at okio.RealBufferedSource.readUtf8LineStrict(RealBufferedSource.java:216)
	at okio.RealBufferedSource.readUtf8LineStrict(RealBufferedSource.java:210)
	at okhttp3.internal.http1.Http1Codec.readResponseHeaders(Http1Codec.java:189)
	at okhttp3.internal.http.CallServerInterceptor.intercept(CallServerInterceptor.java:75)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
	at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:45)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
	at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:93)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
	at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
	at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:120)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
	at com.auth0.net.TelemetryInterceptor.intercept(TelemetryInterceptor.java:33)
	at okhttp3.i

Request: publish new release with v2/users-by-email endpoint

Hi!

As you might already know, Auth0 API now provide a new - optimized - endpoint to fetch user by their emails : https://auth0.com/docs/api/management/v2#!/Users_By_Email/get_users_by_email

I've seen there is some existing code (7625adb) for supporting this new API in auth0-java. @lbalmaceda, do you plan to publish a new release soon ?

Regards,

Connection leakage - during VoidRequest processing its response body wasn't closed

We use 1.3.1 version.
Every time we call auth.resetPassword(email, connection).execute() we afterwards get warning and stack trace in logs:

[warn] o.OkHttpClient - A connection to https://tenant.auth0.com/ was leaked. Did you forget to close a response body?
java.lang.Throwable: response.body().close()
at okhttp3.internal.platform.Platform.getStackTraceForCloseable(Platform.java:143)
at okhttp3.RealCall.captureCallStackTrace(RealCall.java:78)
at okhttp3.RealCall.execute(RealCall.java:66)
at com.auth0.net.BaseRequest.execute(BaseRequest.java:32)
at com.myapp.Wrapper.changePassword(Wrapper.java)

Seems like it is caused by https://github.com/auth0/auth0-java/blob/master/src/main/java/com/auth0/net/VoidRequest.java - when the response is successful, it won't be processed at all, but it should be closed to avoid the issue.

Maven artifactId

the artifactId mentioned in the readme is not consistent with the artifact published in maven repo:

• the readme states "auth0-java"
• the actual artifact in maven is "auth0" - without the "-java"

The maven-central icon is correct (that's how I actually found the artifact). Maybe it is more a problem with the build than the readme as "auth0" seems a bit generic for an artifactId.

Support for new users-by-email endpoint?

Hi,

when will the new users-by-email endpoint be supported?
https://auth0.com/docs/api/management/v2#!/Users_By_Email/get_users_by_email

Kind regards,
Johannes

Submit to jcenter scripts

How do I rotate the managementApi token with this lib?

Management API

Implement methods from Mgt API http://docs.auth0.com/api

Add examples project

Plain java project for sync/async (Android?)

Support Google App engine

We are using google app engine, which unfortunately sets some strict limits on external API requests, and the classes they use. E.i "java.net.ProxySelector is a restricted class"

It seem that under the hood you are using OkHttp, which defaultly is incompatible. Would it be possible to expose a call factory for OkHttpClient like retrofit, so we can patch in the app engine specific call handler?

Password policy for account creation

Are password policy errors accessible from the server side library?
We would like to pass them through to our custom UI via our API.

https://auth0.com/docs/connections/database/password-strength

Support for Auth0 Rate Limits

It would be great if Auth0 Java SDK provides support for a more convenient way to retrieve rate limits from HTTP headers.

For instance, I see two way of improving support :
A. Provide simple accessors for Limit, Remaining, Reset attributes on each returned response
B. Replace com.auth0.APIException by a more precise exception

Add ability to set only certain properties when updating a user.

When calling the management API to update a user, I am always receiving the following exception:

com.auth0.exception.APIException: Request failed with status code 400: Payload validation error: 'Additional properties not allowed: logins_count,last_login,identities,updated_at,created_at,nickname,name,picture,user_id (consider storing them in app_metadata or user_metadata. See "Users Metadata" in https://auth0.com/docs/api/v2/changes for more details)'.

According to the Auth0 API documentation, it looks like we should only be sending properties for the user that have changed (e.g. - email, email_verified, user_metadata, etc.) But, with the current API's implementation, this is not possible and I have had to write my own REST call to make this work (I am just trying to update a user so that user is blocked).

Something similar to this should work:

public Request<User> update(String userId, String json) {
    Asserts.assertNotNull(userId, "user id");
    Asserts.assertNotNull(json, "json");
    String url = this.baseUrl.newBuilder().addPathSegments("api/v2/users").addPathSegment(userId).build().toString();
    CustomRequest<User> request = new CustomRequest(this.client, url, "PATCH", new TypeReference<String>() {
    });
    request.addHeader("Authorization", "Bearer " + this.apiToken);
    request.setBody(json);
    return request;
}

Use different POJO for PATCH /api/v2/users

Since PATCH users has some strict rules we could use a different POJO to make it simpler to modify the user without knowing those rules

New release 1.3.2 containing listByEmail?

Hi,

I want to call the users().listByEmail endpoint but the relevant method seems to be missing from the latest release:

    <dependency>
        <groupId>com.auth0</groupId>
        <artifactId>auth0</artifactId>
        <version>1.3.1</version>
    </dependency>

Could we have a new release please? Or am I missing something?

Thanks.

Get AD connection's provisioning_ticket_url property

I see no way to get the value of the "provisioning_ticket_url" property of an AD connection entity. Could you please add it to the connection POJO? For a common solution it might make sense to have the possibilty to use custom POJOs for the deserialization. Thanks.

UserProfile.getExtraInfo() always null

Im using auth0-java in a SpringBoot application with ng2 on the front side.
Authentication and authorisation goes well but when I can't get user info from the JWT token on the server.
While UserProfile is retrieved without problems, the profile extraInfo is always Null even though I get this info through the support page

see this example :

final Request<UserProfile> request = client.tokenInfo(token.getJwt());
final UserProfile profile = request.execute();
logger.trace("JWT.profile:nickname :"+profile.getNickname()); // OK
Map<String, Object> extraInfo = profile.getExtraInfo();
logger.trace("JWT.profile.size :"+extraInfo.size()); // NULL POINTER

any suggestions ?
thanks.

LogoutUrlBuilder and access_token

LogoutUrlBuilder.java has a withAccessToken() method but the logout API https://auth0.com/docs/api/authentication#logout has no access_token parameter.

Exception when creating com.auth0.authentication.result.Credentials from json

we're trying to use auth0 on appengine. after parsing the response, we got:

java.lang.RuntimeException: Unable to invoke no-args constructor for class com.auth0.authentication.result.Credentials. Register an InstanceCreator with Gson for this type may fix this problem.
at com.google.gson.internal.ConstructorConstructor$12.construct(ConstructorConstructor.java:210)
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$Adapter.read(ReflectiveTypeAdapterFactory.java:186)
at com.auth0.util.JsonRequiredTypeAdapterFactory$1.read(JsonRequiredTypeAdapterFactory.java:28)
at com.google.gson.TypeAdapter$1.read(TypeAdapter.java:199)
at com.google.gson.TypeAdapter.fromJson(TypeAdapter.java:256)
at com.auth0.request.internal.SimpleRequest.execute(SimpleRequest.java:99)
at com.auth0.authentication.TokenRequest.execute(TokenRequest.java:53)

looks like the default ctor is missing?

Social login using the java sdk

@lbalmaceda,

We are using the sdk provided for our login and registration (Thanks!). We also need to implement social login - facebook and google based login & registration in our app.

Can you please help us understand how we can implement the same?

regards
Krithika

Management API Client ?

Hi!

What is current plan (and associated ETA) for implementing Management API Client in this project ?
https://auth0.com/docs/api/v2

Regards,

Release from travis to jcenter