oauth2 vs auth0: missing audience parameter

i’m using swagger-ui 3.2.0, implicit oauth2, and auth0. i’m making use of JWTs. i need to be able to add an audience parameter to the authorization url to convince auth0 to pass back JWTs instead of opaque tokens. i tried the “straight forward” way of specifying an audience and it doesn’t appear to work.

{
  "swagger": "2.0",
  "info": {
    "title": "foo",
    "description": "foo",
    "version": "1.0.0"
  },
  "consumes": "application/json",
  "produces": "application/json",
  "security": {
    "OAuth2": [
      "read",
      "write"
    ]
  },
  "securityDefinitions": {
    "OAuth2": {
      "type": "oauth2",
      "authorizationUrl": "https://test.auth0.com/authorize?audience=https://foo/bar",
      "flow": "implicit",
      "scopes": {
        "read": "for reading",
        "write": "for writing"
      }
    }
  }
}

this ends up redirecting me to:

https://test.auth0.com/authorize?audience=https://foo/bar?response_type=token&client_id=...&redirect_uri=...&state=...

notice the two question marks. when redirected to this page, it fails.

if i modify the url, by hand, and change the second ? to an &, like:

https://test.auth0.com/authorize?audience=https://foo/bar&response_type=token&client_id=...&redirect_uri=...&state=...

and then re-submit, everything works like it should. i end up with a jwt bearer token and everything.

so, my question is: how should i be specifying this audience parameter to the authorizationUrl?

thanks.

Q	A
Bug or feature request?	bug
Which Swagger/OpenAPI version?	2.0
Which Swagger-UI version?	3.2.0
How did you install Swagger-UI?	webjars
Which browser & version?	chrome
Which operating system?	macos

[shockey]

Update

It occurs to me that we have a PR open for this: https://github.com/swagger-api/swagger-ui/pull/3666

I just approved it, so it should be included in tonight’s release. So this will be fixed 😄

[shockey]

@arthuston, yeah, something’s definitely wrong there - please make sure you’re on the latest version, and if so, open a ticket and tag me in it!

if you have the time, setting up a test environment (definition and Auth0 provisioning) that lets us work on this without scaffolding anything out would help to expedite the process 😄