Adding `Auth0.AuthenticationApi` package dependency #148

kailash-b · 2025-05-20T11:15:23Z

Description

Adds Auth0.AuthenticationApi package as a direct dependency.
Developers can now use the features of Auth0.AuthenticationApi without adding/managing a separate reference.
Examples are updated to show how to register the dependency and use the AuthenticationApiClient.
Added a new Auth0CibaService that the developers can register as dependency. It simplifies the CIBA flows and provides a default polling mechanism that the users can opt for. It also provides flexibility for the users to have their own polling mechanism.
Examples are updated to show how to register the dependency and use the Auth0CibaService.

Internal References

Testing

Tested the changes on the sample application as well.
This change adds test coverage for new/changed/fixed functionality

Checklist

I have added documentation for new/changed functionality in this PR or in auth0.com/docs
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used, if not main

andychiare · 2025-05-29T09:45:08Z

...Auth0.AspNetCore.Authentication/ClientInitiatedBackChannelAuthentication/Auth0CibaService.cs

+        while (true)
+        {
+            _logger.LogDebug($"Polling CIBA token endpoint for auth_req_id: {initDetails.AuthRequestId} ");
+            try
+            {
+                var response = await _authenticationApiClient.GetTokenAsync(request);
+
+                return new CibaCompletionDetails
+                {
+                    AccessToken = response.AccessToken,
+                    IdToken = response.IdToken,
+                    TokenType = response.TokenType,
+                    Scope = response.Scope,
+                    ExpiresIn = response.ExpiresIn,
+                    RefreshToken = response.RefreshToken,
+                    IsSuccessful = true,
+                    IsAuthenticationPending = false,
+                };
+            }
+            catch (ErrorApiException ex)
+            {
+                _logger.LogWarning(
+                    ex,
+                    $"CIBA polling error for auth_req_id: {initDetails.AuthRequestId}." +
+                    $" Error: {ex.ApiError.Error}, Description: {ex.ApiError.Message}");
+
+                if (ex.ApiError.Error.Contains("authorization_pending", StringComparison.OrdinalIgnoreCase))
+                {
+                    await Task.Delay(TimeSpan.FromSeconds(initDetails.Interval ?? 5));
+                    continue;
+                }
+
+                return new CibaCompletionDetails
+                {
+                    IsAuthenticationPending = false,
+                    Error = ex.ApiError.Error,
+                    ErrorMessage = ex.ApiError.Message,
+                    IsSuccessful = false
+                };
+            }
+        }


Naive question: 🙂 Is this safe?
I'm always scared by while (true) 🙂 It doesn't explicitly communicate the termination criteria.
I suggest something like the following, but feel free to ignore my comment:

Suggested change

while (true)

{

_logger.LogDebug($"Polling CIBA token endpoint for auth_req_id: {initDetails.AuthRequestId} ");

try

{

var response = await _authenticationApiClient.GetTokenAsync(request);

return new CibaCompletionDetails

{

AccessToken = response.AccessToken,

IdToken = response.IdToken,

TokenType = response.TokenType,

Scope = response.Scope,

ExpiresIn = response.ExpiresIn,

RefreshToken = response.RefreshToken,

IsSuccessful = true,

IsAuthenticationPending = false,

};

}

catch (ErrorApiException ex)

{

_logger.LogWarning(

ex,

$"CIBA polling error for auth_req_id: {initDetails.AuthRequestId}." +

$" Error: {ex.ApiError.Error}, Description: {ex.ApiError.Message}");

if (ex.ApiError.Error.Contains("authorization_pending", StringComparison.OrdinalIgnoreCase))

{

await Task.Delay(TimeSpan.FromSeconds(initDetails.Interval ?? 5));

continue;

}

return new CibaCompletionDetails

{

IsAuthenticationPending = false,

Error = ex.ApiError.Error,

ErrorMessage = ex.ApiError.Message,

IsSuccessful = false

};

}

}

var cibaCompletionDetails = new CibaCompletionDetails

{

IsSuccessful = false,

IsAuthenticationPending = true,

};

while (!cibaCompletionDetails.IsSuccessful && cibaCompletionDetails.IsAuthenticationPending)

{

_logger.LogDebug($"Polling CIBA token endpoint for auth_req_id: {initDetails.AuthRequestId} ");

try

{

var response = await _authenticationApiClient.GetTokenAsync(request);

cibaCompletionDetails.AccessToken = response.AccessToken;

cibaCompletionDetails.IdToken = response.IdToken;

cibaCompletionDetails.TokenType = response.TokenType;

cibaCompletionDetails.Scope = response.Scope;

cibaCompletionDetails.ExpiresIn = response.ExpiresIn;

cibaCompletionDetails.RefreshToken = response.RefreshToken;

cibaCompletionDetails.IsSuccessful = true;

cibaCompletionDetails.IsAuthenticationPending = false;

}

catch (ErrorApiException ex)

{

_logger.LogWarning(

ex,

$"CIBA polling error for auth_req_id: {initDetails.AuthRequestId}." +

$" Error: {ex.ApiError.Error}, Description: {ex.ApiError.Message}");

if (ex.ApiError.Error.Contains("authorization_pending", StringComparison.OrdinalIgnoreCase))

{

await Task.Delay(TimeSpan.FromSeconds(initDetails.Interval ?? 5));

continue;

}

cibaCompletionDetails.IsAuthenticationPending = false;

cibaCompletionDetails.Error = ex.ApiError.Error;

cibaCompletionDetails.ErrorMessage = ex.ApiError.Message;

cibaCompletionDetails.IsSuccessful = false;

}

}

return cibaCompletionDetails;

andychiare · 2025-06-13T08:16:47Z

EXAMPLES.md

@@ -444,3 +444,97 @@ public class LogoutModel : PageModel
    }
 }
 ```
+
+# Accessing Auth0.AuthenticationApi features
+`Auth0.AuthenticationApi` package is our standalone Authentication package that supports a wide range of


Suggested change

`Auth0.AuthenticationApi` package is our standalone Authentication package that supports a wide range of

`Auth0.AuthenticationApi` package is our standalone Authentication package that supports a wide range of

andychiare

Added some suggestions to improve the presentation of the new supported features.
In particular, a reference to the two new sections in the table of contents of the EXAMPLES.md file is missing

andychiare · 2025-06-13T08:19:42Z

EXAMPLES.md

+
+# Accessing Auth0.AuthenticationApi features
+`Auth0.AuthenticationApi` package is our standalone Authentication package that supports a wide range of
+options for Authentication. We can access these features like below : 


Just to give some context of what you are showing below.

Suggested change

options for Authentication. We can access these features like below :

options for Authentication. For example, you can use it to implement the [client credentials flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow), as shown below :

andychiare · 2025-06-13T08:22:00Z

EXAMPLES.md

@@ -444,3 +444,97 @@ public class LogoutModel : PageModel
    }
 }
 ```
+
+# Accessing Auth0.AuthenticationApi features


Add a reference to this section in the table of contents at the top of this doc.

andychiare · 2025-06-13T08:23:37Z

EXAMPLES.md

+}
+```
+
+# Accessing specific features like CIBA


Add a reference to this section in the table of contents at the top of this doc.
I would just say:

Suggested change

# Accessing specific features like CIBA

# Using CIBA

andychiare · 2025-06-13T08:24:37Z

EXAMPLES.md

+/// Program.cs / Startup.cs
+builder.Services.AddAuth0WebAppAuthentication(options =>
+{
+    options.Domain = "domain";


Isn't this required too? 🤔

andychiare · 2025-06-13T08:29:40Z

EXAMPLES.md

+        LoginHint = new LoginHint()
+        {
+            Format = "iss_sub",
+            Issuer = "https://dx-sdks-testing.us.auth0.com/",


Do we want to leave this URL here or indicate as follows:

Suggested change

Issuer = "https://dx-sdks-testing.us.auth0.com/",

Issuer = https://domain", //replace "domain" with your Auth0 domain

kailash-b added 6 commits May 13, 2025 17:57

Reference latest Auth0.AuthenticationApi package

7cfda3a

Reference IAuthenticationApiClient as a dependency

fb4ec7e

Add IAuth0CibaService and its implementation

ac8f7f0

Add test cases for Auth0CibaService

414fd03

Register Auth0CibaService in DI

bca3fc7

Updating Examples.md

2af0fed

kailash-b requested a review from a team as a code owner May 20, 2025 11:15

nandan-bhat previously approved these changes May 21, 2025

View reviewed changes

andychiare reviewed May 29, 2025

View reviewed changes

Refactor to address review comments

4050199

kailash-b dismissed nandan-bhat’s stale review via 4050199 June 12, 2025 06:36

andychiare reviewed Jun 13, 2025

View reviewed changes

Update Examples.md

7808873

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Adding `Auth0.AuthenticationApi` package dependency #148

Adding `Auth0.AuthenticationApi` package dependency #148

kailash-b commented May 20, 2025 •

edited by jira bot

Loading

Uh oh!

andychiare May 29, 2025

Uh oh!

andychiare Jun 13, 2025

Uh oh!

andychiare left a comment

Uh oh!

andychiare Jun 13, 2025

Uh oh!

andychiare Jun 13, 2025

Uh oh!

andychiare Jun 13, 2025

Uh oh!

andychiare Jun 13, 2025

Uh oh!

andychiare Jun 13, 2025

Uh oh!

Uh oh!

	`Auth0.AuthenticationApi` package is our standalone Authentication package that supports a wide range of
	`Auth0.AuthenticationApi` package is our standalone Authentication package that supports a wide range of

	options for Authentication. We can access these features like below :
	options for Authentication. For example, you can use it to implement the [client credentials flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow), as shown below :

	Issuer = "https://dx-sdks-testing.us.auth0.com/",
	Issuer = https://domain", //replace "domain" with your Auth0 domain

Adding Auth0.AuthenticationApi package dependency #148

Are you sure you want to change the base?

Adding Auth0.AuthenticationApi package dependency #148

Conversation

kailash-b commented May 20, 2025 • edited by jira bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Internal References

Testing

Checklist

Uh oh!

andychiare May 29, 2025

Choose a reason for hiding this comment

Uh oh!

andychiare Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

andychiare left a comment

Choose a reason for hiding this comment

Uh oh!

andychiare Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

andychiare Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

andychiare Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

andychiare Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

andychiare Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Adding `Auth0.AuthenticationApi` package dependency #148

Adding `Auth0.AuthenticationApi` package dependency #148

kailash-b commented May 20, 2025 •

edited by jira bot

Loading