auth0 4.17.0 → 5.20.0

data/lib/auth0/api/authentication_endpoints.rb

@@ -2,42 +2,53 @@
 # rubocop:disable Metrics/ModuleLength
 
 require 'jwt'
+require_relative '../client_assertion'
 
 module Auth0
   module Api
     # {https://auth0.com/docs/api/authentication}
     # Methods to use the Authentication API
     module AuthenticationEndpoints
+      include Auth0::ClientAssertion
+
       UP_AUTH = 'Username-Password-Authentication'.freeze
       JWT_BEARER = 'urn:ietf:params:oauth:grant-type:jwt-bearer'.freeze
+      GRANT_TYPE_PASSWORDLESS_OPT = 'http://auth0.com/oauth/grant-type/passwordless/otp'.freeze
 
       # Request an API access token using a Client Credentials grant
       # @see https://auth0.com/docs/api-auth/tutorials/client-credentials
+      # @param client_id [string] Client ID for the application
+      # @param client_secret [string] Client secret for the application. Ignored if using Client Assertion
       # @param audience [string] API audience to use
+      # @param organization [string] Organization ID
       # @return [json] Returns the API token
       def api_token(
         client_id: @client_id,
         client_secret: @client_secret,
-        audience: "https://#{@domain}/api/v2/"
+        organization: @organization,
+        audience: nil
       )
         request_params = {
           grant_type: 'client_credentials',
           client_id: client_id,
-          client_secret: client_secret,
-          audience: audience
+          audience: audience,
+          organization: organization
         }
-        response = post('/oauth/token', request_params)
-        ApiToken.new(response['access_token'], response['scope'], response['expires_in'])
+
+        populate_client_assertion_or_secret(request_params, client_id: client_id, client_secret: client_secret)
+
+        response = request_with_retry(:post, '/oauth/token', request_params)
+        ::Auth0::ApiToken.new(response['access_token'], response['scope'], response['expires_in'])
       end
 
       # Get access and ID tokens using an Authorization Code.
       # @see https://auth0.com/docs/api/authentication#authorization-code
       # @param code [string] The authentication code obtained from /authorize
       # @param redirect_uri [string] URL to redirect to after authorization.
+      # @param client_id [string] Client ID for the application
+      # @param client_secret [string] Client secret for the application. Ignored if using Client Assertion
       #   Required only if it was set at the GET /authorize endpoint
-      # @param client_id [string] Client ID for the Application
-      # @param client_secret [string] Client Secret for the Application.
-      # @return [AccessToken] Returns the access_token and id_token
+      # @return [Auth0::AccessToken] Returns the access_token and id_token
       def exchange_auth_code_for_tokens(
         code,
         redirect_uri: nil,
@@ -48,23 +59,25 @@ module Auth0
 
         request_params = {
           grant_type: 'authorization_code',
-          client_id: client_id,
-          client_secret: client_secret,
+          client_id: client_id,          
           code: code,
           redirect_uri: redirect_uri
         }
-        AccessToken.from_response post('/oauth/token', request_params)
+
+        populate_client_assertion_or_secret(request_params, client_id: client_id, client_secret: client_secret)
+
+        ::Auth0::AccessToken.from_response request_with_retry(:post, '/oauth/token', request_params)
       end
 
       # Get access and ID tokens using a refresh token.
       # @see https://auth0.com/docs/api/authentication#refresh-token
       # @param refresh_token [string] Refresh token to use. Request this with
       #   the offline_access scope when logging in.
-      # @param client_id [string] Client ID for the Application
-      # @param client_secret [string] Client Secret for the Application.
+      # @param client_id [string] Client ID for the application
+      # @param client_secret [string] Client secret for the application. Ignored if using Client Assertion
       #   Required when the Application's Token Endpoint Authentication Method
       #   is Post or Basic.
-      # @return [AccessToken] Returns tokens allowed in the refresh_token
+      # @return [Auth0::AccessToken] Returns tokens allowed in the refresh_token
       def exchange_refresh_token(
         refresh_token,
         client_id: @client_id,
@@ -75,10 +88,54 @@ module Auth0
         request_params = {
           grant_type: 'refresh_token',
           client_id: client_id,
-          client_secret: client_secret,
           refresh_token: refresh_token
         }
-        AccessToken.from_response post('/oauth/token', request_params)
+
+        populate_client_assertion_or_secret(request_params, client_id: client_id, client_secret: client_secret)
+
+        ::Auth0::AccessToken.from_response request_with_retry(:post, '/oauth/token', request_params)
+      end
+
+      # Exchange an OTP recieved through SMS for ID and access tokens
+      # @param phone_number [string] The user's phone number used to receive the OTP
+      # @param otp [string] The OTP contained in the SMS
+      # @param audience [string] The audience for the access token (defaults to nil)
+      # @param scope [string] The scope (defaults to 'openid profile email')
+      def exchange_sms_otp_for_tokens(phone_number, otp, audience: nil, scope: nil)
+        request_params = {
+          grant_type: GRANT_TYPE_PASSWORDLESS_OPT,
+          client_id: @client_id,
+          username: phone_number,
+          otp: otp,
+          realm: 'sms',
+          audience: audience,
+          scope: scope || 'openid profile email'
+        }
+
+        populate_client_assertion_or_secret(request_params)
+
+        ::Auth0::AccessToken.from_response request_with_retry(:post, '/oauth/token', request_params)
+      end
+
+      # Exchange an OTP recieved through email for ID and access tokens
+      # @param email_address [string] The user's email address used to receive the OTP
+      # @param otp [string] The OTP contained in the email
+      # @param audience [string] The audience for the access token (defaults to nil)
+      # @param scope [string] The scope (defaults to 'openid profile email')
+      def exchange_email_otp_for_tokens(email_address, otp, audience: nil, scope: nil)
+        request_params = {
+          grant_type: GRANT_TYPE_PASSWORDLESS_OPT,
+          client_id: @client_id,
+          username: email_address,
+          otp: otp,
+          realm: 'email',
+          audience: audience,
+          scope: scope || 'openid profile email'
+        }
+
+        populate_client_assertion_or_secret(request_params)
+
+        ::Auth0::AccessToken.from_response request_with_retry(:post, '/oauth/token', request_params)
       end
 
       # rubocop:disable Metrics/ParameterLists
@@ -87,8 +144,8 @@ module Auth0
       # @see https://auth0.com/docs/api/authentication#resource-owner-password
       # @param login_name [string] Email or username for the connection
       # @param password [string] Password
-      # @param client_id [string] Client ID from Application settings
-      # @param client_secret [string] Client Secret from Application settings
+      # @param client_id [string] Client ID for the application
+      # @param client_secret [string] Client secret for the application. Ignored if using Client Assertion
       # @param realm [string] Specific realm to authenticate against
       # @param audience [string] API audience
       # @param scope [string] Scope(s) requested
@@ -112,13 +169,15 @@ module Auth0
           username: login_name,
           password: password,
           client_id: client_id,
-          client_secret: client_secret,
           realm: realm,
           scope: scope,
           audience: audience,
           grant_type: realm ? 'http://auth0.com/oauth/grant-type/password-realm' : 'password'
         }
-        AccessToken.from_response post('/oauth/token', request_params)
+
+        populate_client_assertion_or_secret(request_params, client_id: client_id, client_secret: client_secret)
+
+        ::Auth0::AccessToken.from_response request_with_retry(:post, '/oauth/token', request_params)
       end
       # rubocop:enable Metrics/ParameterLists
 
@@ -138,16 +197,18 @@ module Auth0
           connection: connection_name,
           client_id: @client_id
         }
-        post('/dbconnections/signup', request_params)
+
+        request_with_retry(:post, '/dbconnections/signup', request_params)
       end
 
       # Change a user's password or trigger a password reset email.
       # @see https://auth0.com/docs/api/authentication#change-password
       # @see https://auth0.com/docs/connections/database/password-change
       # @param email [string] User's current email
-      # @param password [string] User's new password; empty to trigger a
-      #   password reset email
+      # @param password [string] User's new password. This is only available
+      #   on legacy tenants with change password v1 flow enabled
       # @param connection_name [string] Database connection name
+      # @deprecated Use {#reset_password} instead.
       def change_password(email, password, connection_name = UP_AUTH)
         raise Auth0::InvalidParameter, 'Must supply a valid email' if email.to_s.empty?
 
@@ -157,7 +218,27 @@ module Auth0
           connection: connection_name,
           client_id: @client_id
         }
-        post('/dbconnections/change_password', request_params)
+
+        request_with_retry(:post, '/dbconnections/change_password', request_params)
+      end
+
+      # Trigger a password reset email.
+      # @see https://auth0.com/docs/api/authentication#change-password
+      # @see https://auth0.com/docs/connections/database/password-change
+      # @param email [string] User's current email
+      # @param connection_name [string] Database connection name
+      # @param client_id [string] Client ID override (to allow forwarding
+      #   to a different application's login URI on password reset success page)
+      def reset_password(email, connection_name = UP_AUTH, client_id = @client_id)
+        raise Auth0::InvalidParameter, 'Must supply a valid email' if email.to_s.empty?
+
+        request_params = {
+          email: email,
+          connection: connection_name,
+          client_id: client_id
+        }
+
+        request_with_retry(:post, '/dbconnections/change_password', request_params)
       end
 
       # Start Passwordless email login flow.
@@ -175,9 +256,11 @@ module Auth0
           authParams: auth_params,
           connection: 'email',
           client_id: @client_id,
-          client_secret: @client_secret
         }
-        post('/passwordless/start', request_params)
+
+        populate_client_assertion_or_secret(request_params)
+
+        request_with_retry(:post, '/passwordless/start', request_params)
       end
 
       # Start Passwordless SMS login flow.
@@ -191,36 +274,38 @@ module Auth0
           phone_number: phone_number,
           connection: 'sms',
           client_id: @client_id,
-          client_secret: @client_secret
         }
-        post('/passwordless/start', request_params)
+
+        populate_client_assertion_or_secret(request_params)
+
+        request_with_retry(:post, '/passwordless/start', request_params)
       end
 
       # Retrive SAML 2.0 metadata XML for an Application.
       # @see https://auth0.com/docs/api/authentication#get-metadata
       # @return [xml] SAML 2.0 metadata
       def saml_metadata
-        get("/samlp/metadata/#{@client_id}")
+        request_with_retry(:get, "/samlp/metadata/#{@client_id}")
       end
 
       # Retrieve WS-Federation metadata XML for a tenant.
       # @see https://auth0.com/docs/api/authentication#get-metadata36
       # @return [xml] WS-Federation metadata
       def wsfed_metadata
-        get('/wsfed/FederationMetadata/2007-06/FederationMetadata.xml')
+        request_with_retry(:get, '/wsfed/FederationMetadata/2007-06/FederationMetadata.xml')
       end
 
       # Return the user information based on the Auth0 access token.
       # @see https://auth0.com/docs/api/authentication#get-user-info
       # @return [json] User information based on the Auth0 access token
       def userinfo(access_token)
-        get('/userinfo', {}, 'Authorization' => "Bearer #{access_token}")
+        request_with_retry(:get, '/userinfo', {}, 'Authorization' => "Bearer #{access_token}")
       end
 
       # Return an authorization URL.
       # @see https://auth0.com/docs/api/authentication#authorization-code-grant
       # @param redirect_uri [string] URL to redirect after authorization
-      # @param options [hash] Can contain response_type, connection, state and additional_parameters.
+      # @param options [hash] Can contain response_type, connection, state, organization, invitation, and additional_parameters.
       # @return [url] Authorization URL.
       def authorization_url(redirect_uri, options = {})
         raise Auth0::InvalidParameter, 'Must supply a valid redirect_uri' if redirect_uri.to_s.empty?
@@ -231,12 +316,29 @@ module Auth0
           connection: options.fetch(:connection, nil),
           redirect_uri: redirect_uri,
           state: options.fetch(:state, nil),
-          scope: options.fetch(:scope, nil)
+          scope: options.fetch(:scope, nil),
+          organization: options.fetch(:organization, @organization),
+          invitation: options.fetch(:invitation, nil)
         }.merge(options.fetch(:additional_parameters, {}))
 
         URI::HTTPS.build(host: @domain, path: '/authorize', query: to_query(request_params))
       end
 
+      # Return an authorization URL for PAR requests
+      # @see https://www.rfc-editor.org/rfc/rfc9126.html
+      # @param request_uri [string] The request_uri as obtained by calling `pushed_authorization_request`
+      # @param additional_parameters Any additional parameters to send
+      def par_authorization_url(request_uri)
+        raise Auth0::InvalidParameter, 'Must supply a valid request_uri' if request_uri.to_s.empty?
+
+        request_params = {
+          client_id: @client_id,
+          request_uri: request_uri,
+        }
+
+        URI::HTTPS.build(host: @domain, path: '/authorize', query: to_query(request_params))
+      end
+
       # Returns an Auth0 logout URL with a return URL.
       # @see https://auth0.com/docs/api/authentication#logout
       # @see https://auth0.com/docs/logout
@@ -258,6 +360,28 @@ module Auth0
         )
       end
 
+      # Make a request to the PAR endpoint and receive a `request_uri` to send to the '/authorize' endpoint.
+      # @see https://auth0.com/docs/api/authentication#authorization-code-grant
+      # @param redirect_uri [string] URL to redirect after authorization
+      # @param options [hash] Can contain response_type, connection, state, organization, invitation, and additional_parameters.
+      # @return [url] Authorization URL.
+      def pushed_authorization_request(parameters = {})
+        request_params = {
+          client_id: @client_id,
+          response_type: parameters.fetch(:response_type, 'code'),
+          connection: parameters.fetch(:connection, nil),
+          redirect_uri: parameters.fetch(:redirect_uri, nil),
+          state: parameters.fetch(:state, nil),
+          scope: parameters.fetch(:scope, nil),
+          organization: parameters.fetch(:organization, nil),
+          invitation: parameters.fetch(:invitation, nil)
+        }.merge(parameters.fetch(:additional_parameters, {}))
+
+        populate_client_assertion_or_secret(request_params)
+        
+        request_with_retry(:post_form, '/oauth/par', request_params, {})
+      end
+
       # Return a SAMLP URL.
       # The SAML Request AssertionConsumerServiceURL will be used to POST back
       # the assertion and it must match with the application callback URL.
@@ -292,225 +416,11 @@ module Auth0
         )
       end
 
-      #
-      # DEPRECATED
-      #
-
-      # Retrieve an access token.
-      # @deprecated 4.6.0 - Use the api_token method instead.
-      # @see https://auth0.com/docs/api/authentication#client-credentials
-      # @param access_token [string] Social provider's access_token
-      # @param connection [string] Currently, this endpoint only works for Facebook, Google, Twitter and Weibo
-      # @return [json] Returns the access token
-      def obtain_access_token(access_token = nil, connection = 'facebook', scope = 'openid')
-        if access_token
-          request_params = { client_id: @client_id, access_token: access_token, connection: connection, scope: scope }
-          post('/oauth/access_token', request_params)['access_token']
-        else
-          request_params = { client_id: @client_id, client_secret: @client_secret, grant_type: 'client_credentials' }
-          post('/oauth/token', request_params)['access_token']
-        end
-      end
-
-      # Get access and ID tokens using an Authorization Code.
-      # @deprecated 4.6.0 - Use the exchange_auth_code_for_tokens method instead.
-      # @see https://auth0.com/docs/api/authentication#authorization-code
-      # @param code [string] The access code obtained through passive authentication
-      # @param redirect_uri [string] Url to redirect after authorization
-      # @param connection [string] Currently, this endpoint only works for Facebook, Google, Twitter and Weibo
-      # @param scope [string] Defaults to openid. Can be 'openid name email', 'openid offline_access'
-      # @return [json] Returns the access_token and id_token
-      def obtain_user_tokens(code, redirect_uri, connection = 'facebook', scope = 'openid')
-        raise Auth0::InvalidParameter, 'Must supply a valid code' if code.to_s.empty?
-        raise Auth0::InvalidParameter, 'Must supply a valid redirect_uri' if redirect_uri.to_s.empty?
-
-        request_params = {
-          client_id: @client_id,
-          client_secret: @client_secret,
-          connection: connection,
-          grant_type: 'authorization_code',
-          code: code,
-          scope: scope,
-          redirect_uri: redirect_uri
-        }
-        post('/oauth/token', request_params)
-      end
-
-      # Get access and ID tokens using Resource Owner Password.
-      # @deprecated 4.6.0 - Use the login_with_resource_owner method instead.
-      # @see https://auth0.com/docs/api/authentication#resource-owner-password
-      # @param username [string] Username or email
-      # @param password [string] Password
-      # @param id_token [string] Token's id
-      # @param connection_name [string] Connection name; use a database or
-      #    passwordless connection, Active Directory/LDAP, Windows Azure or ADF
-      # @param options [hash] Additional options - :scope, :grant_type, :device
-      # @return [json] Returns the access_token and id_token
-      def login(username, password, id_token = nil, connection_name = UP_AUTH, options = {})
-        raise Auth0::InvalidParameter, 'Must supply a valid username' if username.to_s.empty?
-        raise Auth0::InvalidParameter, 'Must supply a valid password' if password.to_s.empty?
-
-        request_params = {
-          client_id: @client_id,
-          client_secret: @client_secret,
-          username: username,
-          password: password,
-          scope: options.fetch(:scope, 'openid'),
-          connection: connection_name,
-          grant_type: options.fetch(:grant_type, 'password'),
-          id_token: id_token,
-          device: options.fetch(:device, nil)
-        }
-        post('/oauth/token', request_params)
-      end
-
-      # Return the user information based on the Auth0 access token.
-      # @deprecated 4.6.0 - Use the userinfo method instead.
-      # @see https://auth0.com/docs/api/authentication#get-user-info
-      # @return [json] User information based on the Auth0 access token
-      def user_info
-        get('/userinfo')
-      end
-
-      # Login using phone number + verification code.
-      # @deprecated 4.5.0 - Legacy authentication pipeline; use a Password Grant
-      #   instead - https://auth0.com/docs/api-auth/tutorials/password-grant
-      # @see https://auth0.com/docs/api/authentication#resource-owner
-      # @param phone_number [string] User's phone number.
-      # @param code [string] Verification code.
-      # @return [json] Returns the access token and id token
-      def phone_login(phone_number, code, scope = 'openid')
-        raise Auth0::InvalidParameter, 'Must supply a valid phone number' if phone_number.to_s.empty?
-        raise Auth0::InvalidParameter, 'Must supply a valid code' if code.to_s.empty?
-
-        request_params = {
-          client_id: @client_id,
-          username: phone_number,
-          password: code,
-          scope: scope,
-          connection: 'sms',
-          grant_type: 'password'
-        }
-        post('/oauth/ro', request_params)
-      end
-
-      # Validate a JSON Web Token (signature and expiration).
-      # @deprecated 4.5.0 - Legacy endpoint, use /userinfo instead.
-      # @see https://auth0.com/docs/api/authentication#get-token-info
-      # @param id_token [string] ID Token to use
-      # @return User information associated with the user id (sub property) of the token.
-      def token_info(id_token)
-        raise Auth0::InvalidParameter, 'Must supply a valid id_token' if id_token.to_s.empty?
-
-        request_params = { id_token: id_token }
-        post('/tokeninfo', request_params)
-      end
-
-      # Refresh a delegation token.
-      # @deprecated 4.5.0 - Feature is disabled, no replacement currently; see
-      #   https://auth0.com/docs/api-auth/tutorials/adoption/delegation
-      # @see https://auth0.com/docs/api/authentication#delegation
-      # @param refresh_token [string] Token to refresh
-      # @param target [string] Target to sign the new token.
-      # @param scope [string] Defaults to openid. Can be 'openid name email'.
-      # @param api_type [string] Defaults to app. Can be aws, azure_sb, azure_blob, firebase, layer, salesforce_api,
-      #  salesforce_sandbox_api, sap_api or wams
-      # @param extra_parameters [hash] Extra parameters.
-      # @return [json] Returns the refreshed delegation token
-      def refresh_delegation(refresh_token, target, scope = 'openid', api_type = 'app', extra_parameters = {})
-        raise Auth0::InvalidParameter, 'Must supply a valid token to refresh' if refresh_token.to_s.empty?
-
-        request_params = {
-          client_id: @client_id,
-          grant_type: JWT_BEARER,
-          refresh_token: refresh_token,
-          target: target,
-          api_type: api_type,
-          scope: scope
-        }.merge(extra_parameters)
-        post('/delegation', request_params)
-      end
-
-      # Retrieve a delegation token.
-      # @deprecated 4.5.0 - Feature is disabled, no replacement currently; see
-      #   https://auth0.com/docs/api-auth/tutorials/adoption/delegation
-      # @see https://auth0.com/docs/api/authentication#delegation
-      # @param id_token [string] Token's id.
-      # @param target [string] Target to sign the new token.
-      # @param scope [string] Defaults to openid. Can be 'openid name email'.
-      # @param api_type [string] Defaults to app. Can be aws, azure_sb, azure_blob, firebase, layer, salesforce_api,
-      #  salesforce_sandbox_api, sap_api or wams
-      # @param extra_parameters [hash] Extra parameters.
-      # @return [json] Returns the refreshed delegation token
-      def delegation(id_token, target, scope = 'openid', api_type = 'app', extra_parameters = {})
-        raise Auth0::InvalidParameter, 'Must supply a valid id_token' if id_token.to_s.empty?
-
-        request_params = {
-          client_id: @client_id,
-          grant_type: JWT_BEARER,
-          id_token: id_token,
-          target: target,
-          api_type: api_type,
-          scope: scope
-        }.merge(extra_parameters)
-        post('/delegation', request_params)
-      end
-
-      # Retrieve an impersonation URL to login as another user.
-      # @deprecated 4.5.0 - Feature is disabled.
-      # @see https://auth0.com/docs/api/authentication#impersonation
-      # @param user_id [string] Impersonate user id
-      # @param app_client_id [string] Application client id
-      # @param impersonator_id [string] Impersonator user id id.
-      # @param options [string] Additional Parameters
-      # @return [string] Impersonation URL
-      # rubocop:disable Metrics/MethodLength, Metrics/AbcSize
-      def impersonate(user_id, app_client_id, impersonator_id, options)
-        raise Auth0::InvalidParameter, 'Must supply a valid user_id' if user_id.to_s.empty?
-        raise Auth0::InvalidParameter, 'Must supply a valid app_client_id' if app_client_id.to_s.empty?
-        raise Auth0::InvalidParameter, 'Must supply a valid impersonator_id' if impersonator_id.to_s.empty?
-        raise Auth0::MissingParameter, 'Must supply client_secret' if @client_secret.nil?
-
-        authorization_header obtain_access_token
-        request_params = {
-          protocol: options.fetch(:protocol, 'oauth2'),
-          impersonator_id: impersonator_id,
-          client_id: app_client_id,
-          additionalParameters: {
-            response_type: options.fetch(:response_type, 'code'),
-            state: options.fetch(:state, ''),
-            scope: options.fetch(:scope, 'openid'),
-            callback_url: options.fetch(:callback_url, '')
-          }
-        }
-        result = post("/users/#{user_id}/impersonate", request_params)
-        authorization_header @token
-        result
-      end
-      # rubocop:enable Metrics/MethodLength, Metrics/AbcSize
-
-      # Unlink a user's account from the identity provider.
-      # @deprecated 4.5.0 - Endpoint is disabled in favor of the Management API;
-      #   see https://auth0.com/docs/migrations/guides/account-linking
-      # @see https://auth0.com/docs/api/authentication#unlink
-      # @param access_token [string] Logged-in user access token
-      # @param user_id [string] User Id
-      def unlink_user(access_token, user_id)
-        raise Auth0::InvalidParameter, 'Must supply a valid access_token' if access_token.to_s.empty?
-        raise Auth0::InvalidParameter, 'Must supply a valid user_id' if user_id.to_s.empty?
-
-        request_params = {
-          access_token: access_token,
-          user_id: user_id
-        }
-        post('/unlink', request_params)
-      end
-
       # Validate an ID token (signature and expiration).
       # @see https://auth0.com/docs/tokens/guides/validate-id-tokens
       # @param id_token [string] The JWT to validate.
       # @param algorithm [JWKAlgorithm] The expected signing algorithm.
-      #   Defaults to +Auth0::Algorithm::RS256.jwks_url("https://YOUR_AUTH0_DOMAIN/.well-known/jwks.json", lifetime: 10 * 60)+.
+
       # @param leeway [integer] The clock skew to accept when verifying date related claims in seconds.
       #   Must be a non-negative value. Defaults to *60 seconds*.
       # @param nonce [string] The nonce value sent during authentication.
@@ -520,8 +430,10 @@ module Auth0
       #   Defaults to +https://YOUR_AUTH0_DOMAIN/+.
       # @param audience [string] The expected audience claim value.
       #   Defaults to your *Auth0 Client ID*.
+      # @param organization [string] Organization ID
+      #   Defaults to your *Auth0 Organization ID*.
       # rubocop:disable Metrics/MethodLength, Metrics/AbcSize, Metrics/ParameterLists
-      def validate_id_token(id_token, algorithm: nil, leeway: 60, nonce: nil, max_age: nil, issuer: nil, audience: nil)
+      def validate_id_token(id_token, algorithm: nil, leeway: 60, nonce: nil, max_age: nil, issuer: nil, audience: nil, organization: @organization)
         context = {
           issuer: issuer || "https://#{@domain}/",
           audience: audience || @client_id,
@@ -531,6 +443,7 @@ module Auth0
 
         context[:nonce] = nonce unless nonce.nil?
         context[:max_age] = max_age unless max_age.nil?
+        context[:organization] = organization unless !organization
 
         Auth0::Mixins::Validation::IdTokenValidator.new(context).validate(id_token)
       end