在使用Auth0的golang服务器中查找当前用户名

Question

I am using auth0 and golang for a rest service that is similar implemented as shown here.

I wonder how I can find out the name of the user that is currently triggering a certain API call - for instance if someone requests http://localhost:3000/products - the go handler in this case looks like this:

var ProductsHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    payload, _ := json.Marshal(products)

    w.Header().Set("Content-Type", "application/json")
    w.Write([]byte(payload))
})

Does the request r contain more information about the current user?

Or do I need to find out the current user in the middleware authentication:

func authMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        secret := []byte("{YOUR-AUTH0-API-SECRET}")
        secretProvider := auth0.NewKeyProvider(secret)
        audience := "{YOUR-AUTH0-API-AUDIENCE}"

        configuration := auth0.NewConfiguration(secretProvider, audience, "https://{YOUR-AUTH0-DOMAIN}.auth0.com/", jose.HS256)
        validator := auth0.NewValidator(configuration)

        token, err := validator.ValidateRequest(r)

        if err != nil {
            fmt.Println(err)
            fmt.Println("Token is not valid:", token)
            w.WriteHeader(http.StatusUnauthorized)
            w.Write([]byte("Unauthorized"))
        } else {
            next.ServeHTTP(w, r)
        }
    })
}

Does the token contain more information about the user?

I am a bit lost here. auth0 works perfectly to ensure that only registered persons can use the REST-API, but I want to deliver user specific information. So it depends on the current user what a REST call is handing back. Initially, I was thinking that auth0 would take care of this. Is there a simple way to achieve this?

Answer 1

Yes, you need to use token to get information about request issue.

To sort all you want you need to take a look to next:

• Check out how token extracted in this method: token extraction
• And the Claims here: Claims structure
• And how combine it here: retrieve Claims

The claims have a field

Issuer string `json:"iss,omitempty"`

you are interested in.