This sample demonstrates a pattern to implement "impersonation" kind of a solution but in a safer and user controlled manner. The sample enables sharing limited access of "my account" to an admin/Helpdesk user to troubleshoot account related issues.
The sample assumes both primary user and the help desk user are assumed to be in the same Auth0 connection.
git clone [email protected]:zamd/user-controlled-access-sample.git
cd user-controlled-access-sample
npm i
-
Create a
Regular Web App
in Auth0 dashboard -
Set
Allowed Callback Urls
. The default setup useshttp://localhost:3000/login/callback
-
Create and enable a database connection on this app
-
Create two users in above database connection as:
-
Go to
Apis
-->Auth0 Management API
and authorizeRegular Web App
client toread:users
update:users
scopes -
Copy
client_id
client_secet
to .env file. -
Sample
.env
file:
Domain=test-access.auth0.com
ClientID=232323232
ClientSecret=32-4_YTz6Y1uT
CallbackURL=http://loopback.com:3000/login/callback
- Create
user-controlled-access
rule with following sample code:
function (user, context, callback) {
var _ =require('[email protected]');
var requestedScopes = context.request.query && context.request.query.scope.split(' ') || [];
var targetScope = requestedScopes.find(s=>s.indexOf('user_controlled_access')!==-1);
if (targetScope) {
//TODO: validate/verify authorized_access depending on application's domain.
var onwerId = targetScope.split('/')[1];
var ag = user.app_metadata.access_grants.find(ag=>ag.owner_id===onwerId);
context.idToken["http://user.controlled.access/authorized_access"] = ag;
}
callback(null, user, context);
}
npm start
- Browser to
http://localhost:3000
and login with[email protected]
user. - Select
Manage access
and give[email protected]
restricted access
- Now, logout and login in as
[email protected]
and you can switch to restricted access view.