Use '.well-known/openid-configuration' to configure Auth0Provider (Auth0Client) calls

[johnny-the-coder]

Use '.well-known/openid-configuration' to configure Auth0Provider (Auth0Client) calls

[frederikprijck]

https://github.com/panva/oauth4webapi is probably a good one if u look for an OIDC compliant SDK.

[frederikprijck]

Thanks for reaching out.

In my case 'authorize' endpoint is 'oauth2/authorize' and 'oauth/token' is 'ouath2/token'.

Are you using Auth0 or some other Identity Provider?

In case you are using another Identity Provider, please understand that this SDK is made for Auth0 and has internal functionality specifically designed to work for Auth0 and will not work with other identity providers.

This is also why we have not made the endpoint URLs configurable, as we do not currently support other identity providers.

If you are using Auth0, can you elaborate on why your URLs are different from the ones we use defaullt?

[johnny-the-coder]

Hi Frederik,

I guess we can both agree that the library would be much more versatile and useful when it would consider ./well-known/openid-configuration.

I searched in the web and there are people struggling with the exact same problem, e.g.:
https://stackoverflow.com/questions/68187471/why-does-google-use-oauth2-auth-and-auth0-spec-uses-oauth2-authorize

I think it would not make a huge effort to implement the necessary changes.
So why not make a much more powerful open-source library?

[frederikprijck]

I guess we can both agree that the library would be much more versatile and useful when it would consider ./well-known/openid-configuration.

I disagree. I agree it would be better if it was more OpenID compliant and not Auth0 focussed, but that is not solved by simply using the well known.

So why not make a much more powerful open-source library?

That would make it look as if we support other identity providers, which we do not because of other internal stuff that depends on Auth0 (not just the endpoint urls). So not supporting other endpoint urls is deliberate for now, even though I would love to see it evolve to be more OIDC compliant as well, but that is not something we currently plan to do.

I searched in the web and there are people struggling with the exact same problem, e.g.:

This is an Auth0 specific SDK, and we nowhere mention it works with others or is OIDC compliant. I understand the issue, but it's not the correct expectation when using our SDK in its current state.

This is also mentioned on the SO link u shared:

Generally though I avoid vendor specific libraries for this type of reason.

[johnny-the-coder]

ok, thanks for the information, I will search for another library then.

[johnny-the-coder]

closing for now