Azure Mobile User Authentication with Cordova

Question

I currently have a backend solution for my application using Azure Mobile Apps. I have included login, twitter, google and Microsoft. Also, I am trying to add a user login. I have an Auth0 account and application installed, and I can get the token and profile back from auth0 when I make a request in the application using the auth0 lock widget.

I followed this guide: https://shellmonger.com/2016/04/08/30-days-of-zumo-v2-azure-mobile-apps-day-5-custom-authentication/ and went to the "Custom Validation" stage JWT on the server ", but this is where I got stuck ... my backend is in C # not node.js, since I can do the equivalent of this tutorial and check the JWT token and subsequently access the table controllers from my external application using azureClient.login / azureClient.table?

EDIT: Well, as you will see in the comment the thread below with @AdrianHall I managed to create a token from my cordova application, but my sticking point now is receiving a service to accept it without exchanging tokens. This is possible according to the published manual.

This is my client side code that is currently making an auth call to auth0 and creates some client side to get the user id and generates a currentUser object containing the new token.

auth0.lock.show(auth0.options, function(err, profile, token) { if (err) { console.error('Error authenticating with Auth0: ', err); alert(err); } else { debugger; var userID; if (profile.user_id.indexOf("auth0") > -1) { userID = profile.user_id.replace("auth0|", ""); } else if (profile.user_id.indexOf("facebook") > -1) { userID = profile.user_id.replace("facebook|", ""); } else if (profile.user_id.indexOf("twitter") > -1) { userID = profile.user_id.replace("twitter|", ""); } else if (profile.user_id.indexOf("microsoft") > -1) { userID = profile.user_id.replace("microsoft|", ""); } else if (profile.user_id.indexOf("google-oauth2") > -1) { userID = profile.user_id.replace("google-oauth2|", ""); } window.azureClient.currentUser = { userId: userID, profile: profile, mobileServiceAuthenticationToken: token }; //A client session has now been created which contains attributes relevant to the currently logged in user. console.log("window.azureClient.currentUser", window.azureClient.currentUser); window.localStorage.setItem("currentUser", JSON.stringify(window.azureClient.currentUser)); //Call the get profile function which will call our API to get the user activities and bio etc. getProfile(); } 

Internal Code MobileAppSettingsDictionary

 settings = config.GetMobileAppSettingsProvider().GetMobileAppSettings(); if (string.IsNullOrEmpty(settings.HostName)) { //This middleware is intended to be used locally for debugging.By default, HostName will //only have a value when running in an App Service application. app.UseAppServiceAuthentication(new AppServiceAuthenticationOptions { SigningKey = ConfigurationManager.AppSettings[""], ValidAudiences = new[] { ConfigurationManager.AppSettings[""] }, ValidIssuers = new[] { ConfigurationManager.AppSettings["https://domain.eu.auth0.com/"] }, TokenHandler = config.GetAppServiceTokenHandler() }); } 

Answer 1

The Azure Mobile Apps C # App_Start\Startup.Mobile.cs has an App_Start\Startup.Mobile.cs with the following code:

  MobileAppSettingsDictionary settings = config.GetMobileAppSettingsProvider().GetMobileAppSettings(); if (string.IsNullOrEmpty(settings.HostName)) { // This middleware is intended to be used locally for debugging. By default, HostName will // only have a value when running in an App Service application. app.UseAppServiceAuthentication(new AppServiceAuthenticationOptions { SigningKey = ConfigurationManager.AppSettings["SigningKey"], ValidAudiences = new[] { ConfigurationManager.AppSettings["ValidAudience"] }, ValidIssuers = new[] { ConfigurationManager.AppSettings["ValidIssuer"] }, TokenHandler = config.GetAppServiceTokenHandler() }); } 

Calling app.UseAppServiceAuthentication sets up the configuration necessary to decode your JWT. You just need to understand what your Audience is (the audit field in JWT) and the Issuer (the iss field is JWT). In the case of auth0, the audience is your ClientId and the issuer is https: // your-domain-value "- the client’s secret key is the signature key

You can verify the JWT example by cutting and pasting at https://jwt.io - this will clearly show what values ​​should be, and you can verify the signature.