Users should not be forced to provide clientSecret to do an active login. about auth0.net

[dschenkelman]

Hey @nicosabena,

Let's go with the static method idea, taking both clientId and domain parameters. It would nice to use a static Dictionary<string, RestClient> as a cache to avoid creating a new rest client every time it it called.

I think that is the best way to do it with the current code without breaking the API. Eventually if we see that more of these methods (that don't require clientSecret) are to be added to the API then we can introduce a better design with an Auth0Credentials object that takes care of GetToken() only if a clientSecret was provided when it was created (and otherwise throws).

Thanks,

[nicosabena]

The RestClient constructor is extremely lightweight, so I wouldn't worry about caching it.
Another option could be to have two "levels" of the Client instance:

• The current one, when you provide both ClientId and ClientSecret in the constructor, that lets you access any method.

    var client = new Auth0.Client(clientId, clientSecret, domain);
    // I can do whatever I want, yeah!
    client.CreateConnection(...);

• Another one, when you provide only the ClientId (and the domain, of course), that would only let you execute methods that do not require a token/clientSecret.

    var client = new Auth0.Client(clientId, domain);
    // restricted Access
    var token = client.LoginUser(...);
    // throws
    client.CreateConnection(); // SecurityException or something

I'm just thinking out loud here, but sound better tan the static method. Opinions?

[dschenkelman]

@nicosabena I like the two constructors alternative. We need to update GetAccesToken to throw if no secret is provided.

Nice!