Auth0 - Integration tests using an actual user

Question

I've been writing integration tests for authentication with Auth0. To achieve this, the tests use a client key and secret along with a grant type of client_credentials to test my API, but the API itself usually deals with authenticated users via the password grant type.

Although I have now implemented logic that pulls out the users details via the ID that had been stored from a previous call but because I have used a client rather than an actual user for my tests, I get an error back when trying to get the details of that user. This works absolutely fine when I have a standard user, eg auth0|abcdefgh when authenticating manually via a front end with a callback. But when I have the user id from the automated tests, I have a client ID abcdefg@clients , which I then can't get any details such as 'First Name' from.

Is it possible to either programmatically login with an actual user in my integration tests or make it so that Auth0 manipulates the properties when using an ID generated from my client credentials. EG state that the first name is test for that client etc. The client credentials have worked well so far, but now I actually try to get further details about the user, it's come undone!

Answer 1

In the end, I followed the steps here https://auth0.com/docs/api-auth/tutorials/password-grant

In summary:

1. Add the Password Grant Type in the advanced settings of the application in Auth0.
2. Configure the Tenants Default Directory to be the connection to use.
3. Request the token in a similar manner to below (other language and curl examples can be found using the link above)

var client = new RestClient("https://YOUR_DOMAIN/oauth/token");
var request = new RestRequest(Method.POST);

request.AddHeader("content-type", "application/x-www-form-urlencoded");
request.AddParameter("application/x-www-form-urlencoded", "grant_type=password&username=user%40example.com&password=pwd&audience=YOUR_API_IDENTIFIER&scope=read%3Asample&client_id=%24%7Baccount.clientId%7D&client_secret=YOUR_CLIENT_SECRET", ParameterType.RequestBody);

IRestResponse response = client.Execute(request);

It is worth noting that this got nowhere near our production environment!

On a side note, if you have any customer MFA, you might need to add to the rule to make sure that your integration test user doesn't go through the MFA route.