Discord connection scope override not working about passport-auth0

[davidpatrick]

Hey @botv thanks for raising the issue, we will take a look and see what is going on

[davidpatrick]

@botv this appears to be happening on the Auth0 server side. Passport is passing the correct encoding of connection_scope to Auth0 url, but the redirect from the Auth0 server to Discord seems to be trying to join the connection_scope with scope and making identify email guilds.join,identify. I will reach out to the team that maintains this connection and see if we can get to the bottom of this.

[botv]

@davidpatrick any update on this?

[davidpatrick]

Hey @botv I just got back from vacation today, sorry for the delay. It looks like our authorize endpoint currently accepts comma delimited lists for connection_scope as documented here https://auth0.com/docs/connections/adding-scopes-for-an-external-idp#2-pass-scopes-to-authorize-endpoint

I am waiting for clarification from the team on supporting this space delimited lists, which is what Discord is expecting.

[botv]

Sounds great, and thanks so much for the support. Any idea how soon we'll hear about this? We're waiting on this patch to switch to Auth0, Discord doesn't support wildcard redirects so the faster we can get this fixed the better.

[davidpatrick]

Okay @botv it looks like you will need to patch the connection through the Auth0 Management API. You can do this directly through the documentation https://auth0.com/docs/api/management/v2#!/Connections/patch_connections_by_id the id will be your connection identifier con_dZGkZnKPGP1ZzBt7 and your payload will look something like (set the client creds):

{
  "options": {
    "scripts": {
      "fetchUserProfile": "function fetchUserProfile(accessToken, context, callback) {\n  request.get({\n    url: 'https://discordapp.com/api/users/@me',\n    headers: {\n      'Authorization': 'Bearer ' + accessToken\n    }\n  },\n  (err, resp, body) => {\n    if (err) {\n      return callback(err);\n    }\n\n    if (resp.statusCode !== 200) {\n      return callback(new Error(`[Response code: ${resp.statusCode}] ${body}`));\n    }\n\n    let bodyParsed;\n    try {\n      bodyParsed = JSON.parse(body);\n    } catch (jsonError) {\n      return callback(new Error(body));\n    }\n\n    return callback(null, bodyParsed);\n  });\n}"
    },
    "icon_url": "https://cdn.auth0.com/marketplace/catalog/content/assets/creators/discord/discord-avatar.png",
    "tokenURL": "https://discordapp.com/api/oauth2/token",
    "client_id": "", // set your client id
    "client_secret": "", // set your client secret
    "authorizationURL": "https://discordapp.com/api/oauth2/authorize",
    "integration_name": "discord"
  }
}

You can verify it has the correct scope by retrieving the connection through https://auth0.com/docs/api/management/v2#!/Connections/get_connections_by_id