Authentication profile is not set correctly

[madsjk816]

Checklist

• I have looked into the README and have not found a suitable solution or answer.
• I have looked into the documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have upgraded to the latest version of this tool and the issue still persists.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Since upgrading the auth0-deploy-cli tool from version 7.17.5 to the latest version 7.19.0 the 'Authentication Profile' setting is not being correctly deployed.

When deploying using version 7.17.5 the 'Authentication Profile' setting regarding identifier first is respected and set correctly, however, when deploying using version 7.19.0 the 'Authentication Profile' seems to be set to 'Identifier + password' which is quite unfortunate when you rely on password-less logins.

I've tried back and forth to slim down the tenant.yaml file to see what might cause the conflict, and it seems that the 'branding' part of it causes the issue to appear. If i remove the branding part of the .yaml file the 'Authentication Profile' is set to 'identifier-first' using both versions of the cli-tool

Expectation

When using the following setting in the tenant.yaml file

prompts:
  identifier_first: true

Identifier first is set as the authentication profile. If it is not possible due to conflicting settings would expect the tool to either throw a warning or an error.

Reproduction

A .yaml file with the following contents:

branding:
  logo_url: >-
    https://upload.wikimedia.org/wikipedia/commons/thumb/5/5b/Logo_de_Auth0.svg/800px-Logo_de_Auth0.svg.png?20211214133710
prompts:
  identifier_first: true
  universal_login_experience: new

run npm install -g auth0-deploy-cli@7.17.5

'Identifier First' should be respected when using this version.

Next up:

run npm install -g auth0-deploy-cli@7.19.0

The authentication profile is now set to 'Identifier + password'

Do the same procedure with the following contents in the tenant.yaml file instead:

prompts:
  identifier_first: true
  universal_login_experience: new

The 'identifier first' authentication profile is now set correctly using both versions of the cli-tool.

Deploy CLI version

7.19.0

Node version

16.14.2

[madsjk816]

Hi Auth0,

Any updates on this issue?

[danielmalmros]

Any updates?

[willvedd]

I'm unable to replicate the difference in behavior between v7.17.5 and current. However, I believe this can be resolved by configuring the webauthn_platform_first_factor property in addition to identifier_first. See below to see how to achieve each configuration profile:

Identifier + Password

prompts:
  identifier_first: false
  webauthn_platform_first_factor: false

Identifier First

prompts:
  identifier_first: true
  webauthn_platform_first_factor: false

Identifier First + Biometrics

prompts:
  identifier_first: true
  webauthn_platform_first_factor: true

Please advise wether or not this resolves your issue.

[willvedd]

All - I'm considering this issue resolved. Please re-open if you're still unable to achieve the desired configuration profile.

[victornvg]

@willvedd I got the same issue for this, here is my setup in tenant.yaml file

prompts:
  identifier_first: true
  universal_login_experience: new
  webauthn_platform_first_factor: false

When I execute the command a0deploy import --input_file tenant.yaml --config_file config.json --debug, I do not see any log entries related to prompts.
Additionally, the Authentication Profile does not change to Identifier First.

I’m using auth0-deploy-cli version v7.24.0 and node version v20.14.0

[csharpsi]

I also have this issue. Exact same values as @victornvg in my tenant.yml file and I have the same behaviour. Authentication Profile is set to Identifier + Password incorrectly.

[victornvg]

@csharpsi I identified the issue, it was due to my config file. The AUTH0_EXCLUDED setting is excluding prompts from being updated. So remove prompts from this config fixed the issue. Hope this helps!

"AUTH0_EXCLUDED": [
    "customDomains", "prompts", "logStreams", "branding"
]

[MattHartz]

@willvedd still doesn't work and @victornvg my code isn't excluded.

[victornvg]

@MattHartz can you share your config file?

[MattHartz]

Hi @victornvg ,

Sure! Thank you! I scrubbed some data so if you see some weirdness, it might be that :)

tenant_for_github.yaml

[MattHartz]

I am going to reopen a ticket for this because this is a major issue for us

[jKlag]

I am also running into this issue with CLI version 8.17.0. I'm not setting AUTH0_EXCLUDED env variable at all and the prompts section of my tenant.yaml is:

prompts:
  customText: {}
  identifier_first: true
  partials: {}
  universal_login_experience: new
  webauthn_platform_first_factor: false

And it resets the auth profile to "Identifier + Password" every time I deploy.