title: Auth0 API + Spring: How to verify user identity from successful Auth0 API response
body: <h1>Problem</h1>
  
  <p>I'm trying to create an app that uses <strong>Auth0 SPA + React</strong> on the frontend to auth users without ever having to deal with passwords. Then, I'd like to secure any endpoints I create using an <strong>Auth</strong> server that I'm required to create using the <strong>Spring Framework</strong>.</p>
  
  <p>Just to clarify, the flow would be</p>
  
  <pre><code>Frontend -&gt;
  Auth through Auth0 -&gt;
  Redirect to users dashboard on frontend -&gt;
  Make HTTP request to endpoint sending JWT returned from Auth0 -&gt;
  Endpoint makes request to my Auth Server sending JWT returned from Auth0 -&gt;
  Auth server either either returns 401 or user object based on JWT -&gt;
  Endpoint grabs data specific to that user from DB -&gt;
  Returns data to frontend
  </code></pre>
  
  <p>I've managed to get my frontend to work just fine using the <strong>Quickstart Guide</strong> that <strong>Auth0</strong> provides but I'm having a lot of trouble figuring out how to get my <strong>Auth Service</strong> to verify the user.</p>
  
  <p>I believe I've come to the conclusion that I need to create an "<strong>API</strong>" on <strong>Auth0</strong> and grab an <strong>access token</strong> and use that to validate the JWT, which in this case is just the <strong>access token</strong> and not the JWT that my frontend contains. I've also got this part working but there doesn't seem to be a way to know who the user is. When testing this "<strong>API</strong>", after sending a valid request I am returned</p>
  
  <pre><code>{
    "iss": "https://${username}.auth0.com/",
    "sub": "${alphanumericCharacters}@clients",
    "aud": "${ApiIdentifier}",
    "iat": ${issuedAt},
    "exp": ${expiresAt},
    "azp": "${alphanumericCharacters}",
    "gty": "client-credentials"
  }
  </code></pre>
  
  <p>While it's good to know I'm on the right track I can't seem to figure out what to do with this response to find the user.</p>
  
  <h1>Expected</h1>
  
  <p>I expect to be able to identify a specific user after validating an <strong>access_token</strong> from my <strong>Auth Service</strong></p>
  
  <h1>Code</h1>
  
  <p>I don't have much code to show but I'll provide what I can from my <strong>Auth Service</strong></p>
  
  <h2>SecurityConfiguration.java</h2>
  
  <pre class="lang-java prettyprint-override"><code>@EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Value("${auth0.audience}")
      private String audience;
  
      @Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")
      private String issuer;
  
      @Override
      public void configure(HttpSecurity httpSecurity) throws Exception {
          httpSecurity.authorizeRequests()
                  .mvcMatchers("/api/validate")
                      .authenticated()
                  .and()
                  .oauth2ResourceServer()
                      .jwt();
      }
  
      @Bean
      JwtDecoder jwtDecoder() {
          NimbusJwtDecoderJwkSupport jwtDecoder = (NimbusJwtDecoderJwkSupport)
                  JwtDecoders.fromOidcIssuerLocation(issuer);
  
          OAuth2TokenValidator&lt;Jwt&gt; audienceValidator = new AudienceValidator(audience);
          OAuth2TokenValidator&lt;Jwt&gt; withIssuer = JwtValidators.createDefaultWithIssuer(issuer);
          OAuth2TokenValidator&lt;Jwt&gt; withAudience = new DelegatingOAuth2TokenValidator&lt;&gt;(withIssuer, audienceValidator);
  
          jwtDecoder.setJwtValidator(withAudience);
  
          return jwtDecoder;
      }
  
  }
  </code></pre>
  
  <h2>AudienceValidator.java</h2>
  
  <pre class="lang-java prettyprint-override"><code>public class AudienceValidator implements OAuth2TokenValidator&lt;Jwt&gt; {
      private final String audience;
  
      public AudienceValidator(String audience) {
          this.audience = audience;
      }
  
      public OAuth2TokenValidatorResult validate(Jwt jwt) {
          OAuth2Error error = new OAuth2Error("invalid_token", "The required audience is missing", null);
  
          if (jwt.getAudience().contains(audience)) {
              return OAuth2TokenValidatorResult.success();
          }
          return OAuth2TokenValidatorResult.failure(error);
      }
  }
  </code></pre>
  
  <h2>ValidateController.java</h2>
  
  <pre class="lang-java prettyprint-override"><code>@RestController
  @RequestMapping("/api/validate")
  public class ValidateController {
  
      @GetMapping
      public boolean validate() {
          return true;  // only returns if successfully authed
      }
  
  }
  </code></pre>