get auth0 user metadata as part of user information

Question

I don't find how to get the user_metadata from the Auth0 Authentication api:

$auth0Api = new Authentication($domain, $clientId, $clientSecret);

$tokenInfo = $auth0Api->login([
    'username' => $username,
    'password' => $password,
    'realm' => 'Username-Password-Authentication',
]);
$accessToken = $tokenInfo["access_token"];

$info = $auth0Api->userinfo($accessToken);

The final $info array only contains the main user information, no meta_data at all. I tried creating a rule from the Auth0 side to add stuff to the user itself (doing user.customtag = 'helloworld' for example) and the customization does not show either.

User info retrieved:

{
  "sub":"auth0|XXXX",
  "name":"XXXX@XXXX.com",
  "nickname":"XXXX",
  "picture":"XXXX.png",
  "updated_at":"2017-03-31T08:50:59.819Z",
  "email":"XXXX@XXXX.com",
  "email_verified":true
}

The "Raw Json" tab of that user shows something much more complete:

{
    "email": "XXXX@XXXX.com",
    "email_verified": true,
    "user_id": "auth0|XXXX",
    "picture": "XXXX.png",
    "nickname": "XXXX",
    "identities": [
        {
            "user_id": "XXXX",
            "provider": "auth0",
            "connection": "Username-Password-Authentication",
            "isSocial": false
        }
    ],
    "updated_at": "2017-03-31T08:50:59.819Z",
    "created_at": "2017-03-23T16:03:47.075Z",
    "name": "XXXX",
    "user_metadata": {
        "languageCode": "EN"
    },
    "last_ip": "XXXX",
    "last_login": "XXXX",
    "logins_count": XXXX,
    "blocked_for": [],
    "guardian_enrollments": []
}

How is it supposed to work?

Environment:

• composer: "auth0/auth0-php": "~5.0"
• php 7.1
• Auth0 Free account

Answer 1

Try starting up your application locally, then update the following URL with your own settings and paste it into a web browser:

https://YOUR_TENANT.auth0.com/authorize?client_id=YOUR_CLIENT_ID&response_type=code&scope=openid profile&redirect_uri=YOUR_REDIRECT_URI&nonce=12345

This should at least ensure you are making a request with right scopes etc. You should also ensure you have a User Profile with some "metadata" assigned if you are expecting to read that data post authentication of course ;)