Merge pull request #36 from linuxfoundation/fix/auth0-custom-domain-jwt-audience

Fix JWT audience validation for Auth0 custom domains

Author: fayazg

charts/lfx-v2-auth-service/values.yaml

@@ -138,6 +138,8 @@ app:
       value: null
     AUTH0_AUDIENCE:
       value: null
+    AUTH0_MANAGEMENT_AUDIENCE:
+      value: null
     # Auth0 LFX Profile Client configuration (Regular Web Application for passwordless flows)
     ## Required when using passwordless email linking flow
     AUTH0_LFX_PROFILE_CLIENT_ID:

internal/infrastructure/auth0/jwt_parser.go

@@ -10,7 +10,10 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"os"
+	"strings"
 
+	"github.com/linuxfoundation/lfx-v2-auth-service/pkg/constants"
 	"github.com/linuxfoundation/lfx-v2-auth-service/pkg/errors"
 	"github.com/linuxfoundation/lfx-v2-auth-service/pkg/httpclient"
 	jwtparser "github.com/linuxfoundation/lfx-v2-auth-service/pkg/jwt"
@@ -122,6 +125,9 @@ func NewJWTVerificationConfig(ctx context.Context, domain string, httpClient *ht
 
 			expectedIssuer := fmt.Sprintf("https://%s/", domain)
 			expectedAudience := fmt.Sprintf("https://%s/api/v2/", domain)
+			if override := strings.TrimSpace(os.Getenv(constants.Auth0ManagementAudienceEnvKey)); override != "" {
+				expectedAudience = override
+			}
 
 			slog.InfoContext(ctx, "JWT signature verification enabled",
 				"issuer", expectedIssuer,

pkg/constants/global.go

@@ -57,6 +57,9 @@ const (
 	// Auth0AudienceEnvKey is the environment variable key for the Auth0 audience
 	Auth0AudienceEnvKey = "AUTH0_AUDIENCE"
 
+	// Auth0ManagementAudienceEnvKey is the environment variable key for the Auth0 Management API audience override
+	Auth0ManagementAudienceEnvKey = "AUTH0_MANAGEMENT_AUDIENCE"
+
 	// Auth0 LFX Profile Client configuration (Regular Web Application for passwordless flows)
 	// Auth0LFXProfileClientIDEnvKey is the environment variable key for the LFX Profile Auth0 client ID
 	Auth0LFXProfileClientIDEnvKey = "AUTH0_LFX_PROFILE_CLIENT_ID"