Use omniauth-auth0, a custom OmniAuth strategy, to handle the authentication flow.

Add the following dependencies to your Gemfile:

gem 'omniauth-auth0', '~> 3.0'
gem 'omniauth-rails_csrf_protection', '~> 1.0' # prevents forged authentication requests

Once your gems are added, install the gems with bundle install.

Create a configuration file ./config/auth0.yml to specify your Auth0 domain, client ID, and client secret values located in your Auth0 Dashboard under application Settings.

Create the following initializer file ./config/initializers/auth0.rb and configure the OmniAuth middleware with the configuration file you created in the previous step.

Ensure that callback_path matches the value given in the "Allowed Callback URLs" setting in your Auth0 application.

Create an Auth0 controller to handle the authentication callback, logout action, and methods for constructing the logout URL.

Run the command: rails generate controller auth0 callback failure logout --skip-assets --skip-helper --skip-routes --skip-template-engine.

Inside the callback method, assign the hash of user information - returned as request.env['omniauth.auth'] - to the active session.

To configure logout, clear all the objects stored within the session by calling the reset_session method within the logout action. Then, redirect to the Auth0 logout endpoint. To learn more about reset_session, readRuby on Rails ActionController documentation.

Add these routes to your ./config/routes.rb file.

Routes must be in place so Rails knows how to route the various Auth0 callback URLs to the Auth0 controller you created in the previous step.

A user can now log into your application by visiting the /auth/auth0 endpoint.

<!-- Place a login button anywhere on your application -->
<%= button_to 'Login', '/auth/auth0', method: :post %>

Now that you can log in to your Rails application, you need a way to log out. Log out a user by redirecting to the auth/logout action, which redirects them to the Auth0 logout endpoint.

<!-- Place a logout button anywhere on your application -->
<%= button_to 'Logout', 'auth/logout', method: :get %>

To display the user's profile, your application should provide a protected route. You can use a Concern to control access to routes that can be shared across multiple controllers. The concern should automatically redirect to Auth0 when the user is unauthenticated. Otherwise, the concern should return the current user profile.

Once you have a Concern, include it in any controller that requires a logged in user. You can then access the user from the session session[:userinfo] as in the following example:

class DashboardController < ApplicationController
  include Secured

  def show
    @user = session[:userinfo]
  end
end

Once the user loads from the session, use it to display information in your frontend:

<div>
  <p>Normalized User Profile:<%= JSON.pretty_generate(@user[:info])%></p>
  <p>Full User Profile:<%= JSON.pretty_generate(@user[:extra][:raw_info])%></p>
</div>