Auth0 fails to perform automated tests using the ROPG flow for applications that use organizations. This occurs because the password grant type is not supported for Auth0 applications with organizations enabled. Implement a Custom Token Exchange Trigger to set the user's organization after token validation to resolve the issue.

• Auth0
• Resource Owner Password Credentials Grant (ROPG)
• Organizations
• Automated Testing
• Custom Token Exchange Trigger

The error occurs because the password grant type is not supported for Auth0 applications that have organizations enabled.

How is the Auth0 automated testing issue using ROPG resolved for applications that use organizations?

To resolve the automated testing issue, navigate to the Auth0 Admin Console, create a Custom Token Exchange Action, and configure the script to set the organization after token validation.

1. Navigate to the Auth0 Admin Console.
2. Choose Actions and select Flows.
3. Select Custom Token Exchange to open the flow.
4. Add a new Action or select an existing one to edit.
5. Enter the required JavaScript code to validate the token, apply authorization policies, set the organization, and set the user.

   exports.onExecuteCustomTokenExchange = async (event, api) => {  
     
     // 1. Validate subject_token  
     const subject_token = await validateToken(event.transaction.subject_token, jwksUri);  
     
     // 2. Apply the authorization policy on the user  
     const isAuthorized = await authorizeAccess(subject_token.sub);  
     if (!isAuthorized) {  
       api.access.deny('Unauthorized_login', 'User cannot login due to reason: X');  
     }  
     
     // 3. Set the organization for the transaction  
     api.authentication.setOrganization('<organization_id>');  
     
     // 4. Set the user for the transaction. The setUserByConnection() method may also be used.  
     api.authentication.setUserById(subject_token.sub);  
     
     return;  
   };

6. Select Deploy to save and activate the Action.

NOTE: Custom Token Exchange is only available for the Enterprise, B2B Pro, and B2C Pro subscription tiers.

Related References

• Actions Triggers: custom-token-exchange - API Object