Auth0 with Rails API - ruby-on-rails

Question

I don't have a specific technical issue but a general problem understanding the architecture for using Auth0 for Authentication and then using the returned profile to access a rails API.
I am using Auth0.Lock in React Native and can successfully sign-up and login to my React Native App and store the returned profile and token.
On the Rails side I have create an API and setup Knock (https://github.com/nsarno/knock) as per the instructions to implement JWT Authentication.
What I don't understand is the link between my User model in Rails and my Database in Auth0. Neither the Auth0 documentation or the Knock documentation are clear on how this association happens.
Thanks
Craig

Answer 1

I've created two example projects, a rails API and a front-end app that illustrate auth0 integration in rails. I'm presuming scope claims are present in the tokens to demonstrate at a very basic level how authorization would work in such scenario.
The frontend uses AngularJS, but this is mostly irrelevant as the logic is very basic and can easily be rewritten in any framework.
As joão-angelo hinted, using tokens mostly defeats the need to have a user model at all, you can of course define a user class as convenience wrapper in runtime, but you don't have to store it in the DB. In fact, having user models living in your app and in auth0 may be counter productive, as you'll have to keep them in sync.
Hope this helps!

Answer 2

From looking into the available documentation the following should be possible.
By defining the appropriate scope you can instruct Auth0 to include specific information - claims - within the ID token returned as the outcome of a successful authentication.
If all the user profile information is included in the token itself you can then use Knock in such way that it will create the user model instance from the JWT payload itself without any need to query additional stores.
By default, Knock assumes the payload as a subject (sub) claim containing the entity's id and calls find on the model. If you want to modify this behaviour, implement within your entity model a class method from_token_payload that takes the payload in argument.
class User < ActiveRecord::Base
def self.from_token_payload payload
# Returns a valid user, `nil` or raise
end
end
(source: Knock Customization)
With this approach the token itself is sufficient and there is no further interaction between the Rails API and Auth0. The user model is created from the token and the Auth0 database is not directly accessed by Rails API, it just uses the information stored there and surfaces on the token.
It should be possible to go with other approaches with more direct interaction with the Auth0 database. If you need to go down that route you should look into the Management API (user related endpoints) as a way for you to interact with the Auth0 database from your own application.