Search code examples
oauthauth0google-identity

Auth0 "Custom Social" for Google fails with "Invalid user id."

I setup Auth0 and Google credentials and had it working using the free trial period within Auth0. this is for a side-project so I need to switch to the free tier "Custom Social" Auth0 logins. I followed these instructions but end up with the error "Invalid user id" in both the Auth0 test page and the app I had working with the Social Login that is pre-build by Auth0.

In GCP console I created a "Client ID for Web application"

  • Authorised JavaScript origins = https://MY_TENANT.uk.auth0.com
  • Authorised redirect URIs = https://MY_TENANT.uk.auth0.com/login/callback

GCP "OAuth consent screen"

  • Publishing status = Testing
  • User type = External

App Registration (just setting this to get it working)

  • Application home page = https://auth0.com
  • Application privacy policy link = https://auth0.com
  • Application Terms of Service link = https://auth0.com
  • Authorised domain = auth0.com
  • Your non-sensitive scopes = /auth/userinfo.email
  • Test users = my email address

It generates

  • GCP_CLIENT_ID = XXX.apps.googleusercontent.com
  • GCP_CLIENT_SECRET = YYY

Over in Auth0 I created a new Custom Socal Login

  • Authorization URL = https://accounts.google.com/o/oauth2/auth
  • Token URL = https://oauth2.googleapis.com/token
  • Scope = openid email (spaces set on)
  • Client ID = GCP_CLIENT_ID
  • Client Secret = GCP_CLIENT_SECRET
  • Fetch User Profile Script
function(accessToken, ctx, cb) {
  var p = {
    accessToken: accessToken,
    id_token: ctx.id_token
  };
  cb(null,p);
}

Pres test, Login screen displayed, select test account, then the error is displayed

Solution

  • The answer

    I was badly parsing the response in the fetch javascript.

    the user_id is required, but I'd got the parsing part in my real code wrong

    How did I work it out?

    I have a simple httpDump app written in go that I use for these kinds of things, it just dumps whatever gets sent to it and returns the time.

    I used ngrok to forward my local httpDump to the internet and updated the fetch script to point to my laptop.

    The http request worked, which was nice because to that point I had no idea where the error was.

    I then manually called google with the token and it's response was

    {
  "sub": "a number",
  "picture": "https://lh3.googleusercontent.com/a-/some_number",
  "email": "[email protected]",
  "email_verified": true
}

    and not the structure I'd copied from the Auth0 article I'd found.