alisha-tingle

Alisha Tingle is a Senior Customer Advocate at Auth0 with 10 years of client-facing experience in the tech industry. In her role, she focuses on accelerating self-service customer growth, expanding self-service reach to developers, and generating enterprise growth. Outside of work, Alisha is passionate about teaching pilates and spending time with her family.

Senior Customer Advocate, DLG

Alisha Tingle

Understand the differences between Social and Enterprise Connections to choose the right identity provider for your application.

Social or Enterprise: Which Connection is Right?


5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn what SAML is, how the authentication flow works between an Identity Provider (IdP) and Service Provider (SP), and how to configure SSO with Auth0.

How SAML Authentication Works

cailyn edwards_24-05-16_OktaASM_3465

Senior Security Engineer

Cailyn Edwards

Everything you need to know about IdPs, from how they work to the benefits of using one.

**TL;DR**: IdPs are services that manage entities' digital identities. They help service providers verify the identity of their users and enable SSO to minimize user password fatigue.

## What Is an IdP?

An Identity Provider (IdP) is a service that stores and manages digital identities. These identities can belong to human or software entities. You can imagine an identity provider like a social register from Regency-era England containing information about specific individuals, including names, titles, and familial connections. This information could be used to dictate who should be invited to which events in high society or even to verify that someone is who they say they are. Modern IdPs probably won’t help you get invited to any major society events, but they do ensure that access to digital services is limited to the intended audience.

### What Do We Mean by Identity?
[**Digital identity**](https://auth0.com/docs/get-started/identity-fundamentals/identity-and-access-management) is the mapping of information about an individual to that person or entity. An identity will consist of user information like a username, address, email, etc. A subset of this information is unique and can be used to validate the identity of the entity it’s mapped to. This subset is what makes up a user's identity factors, which can be things like credentials, biometrics, security questions, or device information. These identity factors fit into three categories: knowledge, possession, and inheritance — in other words, something you know, something you have, and something you are.

## Why Are IdPs Important?

IdPs are crucial in the modern world because they allow entities to access resources securely while ensuring that only the users who are supposed to access them are able to access them. While service providers (SPs) can — and often do — manage identities, they have to balance that specialized service with their standard offerings. IdPs have the advantage of focusing primarily on managing and securely storing identities; thus, they are better suited to work with things like [Single Sign-on (SSO)](https://auth0.com/docs/authenticate/single-sign-on) and [Multi-factor Authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication).

## How Do IdPs Work?

IdPs work by allowing users to log in to a variety of service providers using the authentication factors available to them. IdPs often support using existing credentials, like your Google login or a set of credentials set directly with the IdP.

A typical interaction with an IdP might look like this:

1. User requests to log in to the SP
2. SP redirects the user to the IdP for login
3. User enters credentials (or uses other authentication mechanisms)
4. IdP validates the user and reports back to the SP
5. The user is granted or denied access to the SP’s platform

IdPs also allow SPs to have a high level of control over how they manage access. They can have varied policies depending on the resources being accessed and by whom. These policies and rules are managed by admins, and can be changed and improved upon over time.

## What Are the Different Types of IdPs?

You can have different types of identity providers.

**Social** - Social IdPs are an easy way to validate users with minimal friction, saving the user from creating another password and username combination. An example of a social identity provider is Facebook. Web applications can use Auth0 to leverage a social IdP, allowing users to log in using their Facebook credentials.

**Enterprise** - Enterprise IdPs are often used for SSO. They allow employees to have a single set of credentials to access the variety of services needed to do their job. [Okta](https://www.okta.com/) is an example of an enterprise IdP, allowing employees to sign into any applications they are authorized to use through a convenient dashboard.

**Legal** - Legal IdPs are IdPs managed by governments. This is most common in Europe, but is becoming more prevalent elsewhere as well. An example of a legal IdP is [Criipto](https://www.criipto.com/electronic-identities), which offers eIDs for Denmark, Norway, Sweden, and other European countries.

## What Are the Benefits of IdPs?

Because IdPs are specialized in managing identity, they typically offer higher security and easier integration with multiple SPs.

There are many additional benefits to using an IdP, including:

* **Easier Credential Management**: When users have options like SSO, signing in with social or biometric/device-based authentication means one less set of credentials to manage. This leads to less reuse of easy to remember (and easy to guess) passwords — and a secure, seamless experience.
* **Automated User Onboarding and Offboarding**: With identity managed in one place, it’s easier to grant and revoke permissions at once based on things like group membership.
* **Allows SP to Focus on Core Offerings**: Dedicated identity management empowers service providers to concentrate on their primary business functions. By partnering with expert IdPs, SPs ensure secure identity management while devoting their resources to what matters most to their customers.
* **Better Identity Security**: IdPs have significant field experience, are dedicated to identity management, setting industry standards, and focus on protecting user data.
* **Increased Telemetry**: Identity management is the core product of IdPs, and they treat it as such. An IdP tracks who accessed what and when — which is useful for compliance, audits, and incident response.
* **Multiple Ways to Authenticate**: Users and SPs can choose the authentication options that work best for them, meaning less friction on sign-up and login.
* **Service Agnostic:** If you manage multiple service providers, or a user has worked for multiple tech companies, you will likely have run into the same IdPs. This makes onboarding and management easier — and allows you to leverage your existing knowledge. 

## FAQs

**What’s the difference between an IdP and a Single Sign-On (SSO) provider?**

While an IdP stores and manages digital identities, SSO is an authentication mechanism that allows a single user identity to access multiple service providers. SSO will still use an IdP to verify the user’s identity, and link it to a collection of applications a user can access. Think of an employee dashboard that allows the employee to use their corporate login to access their HR tools, travel planning, email, and so on.

**How do IdPs work with MFAs?**

Service providers can define policies for specific resources and user groups. Many IdPs support specifying the requirement for MFA, what MFAs are supported, and the lifespan of the MFA confirmation in these security policies. Most IdPs have their own MFA options, for example [Okta Verify](https://help.okta.com/en-us/content/topics/mobile/okta-verify-overview.htm).

**Can I move users from my custom-built solution to an IdP?**

Most IdPs will allow the import of users from external applications, allowing you to up your security and reduce your workload in just a few clicks. In the case of Auth0, we can support [automatic migrations](https://auth0.com/docs/manage-users/user-migration), so you can make the switch with little to no impact on your users.

## Conclusion

IdPs are a purpose-built solution that helps both SPs and users access resources securely. They allow SPs to manage granular access policies and reduce the mental load of credential management. IdPs are feature-rich identity and access management solutions, and they’re becoming even more crucial in the ever-evolving technical landscape. If you’re interested in learning about the future of IAM, you can [read about the identity challenges facing AI-powered applications](https://auth0.com/blog/identity-challenges-for-ai-powered-apps/).


What is an IdP (aka Identity Provider)?

Majid Hajian

I am a Google Developer Expert and Media Developer Expert and a passionate software developer with years of developing and architecting complex web and mobile applications. my passions are Flutter, PWA, and performance. I love sharing my knowledge with the community by writing and speaking, contributing to open source, and organizing meetups and events.

Google Developer Expert

In this tutorial, you’ll learn how to enhance your Flutter apps by enabling authentication, supporting federated identity providers, adding authorization by introducing roles and permissions, all leveraging Auth0.

In the exercise from the previous section, you added Auth0 authentication to an existing Flutter app. This added a username/password authentication flow to the app. You also gave the app the ability to request and submit refresh tokens, which enhance the user experience by not requiring the user to authenticate every time they use the app.

This section will expand on the app by examining some useful Auth0 features:

* Refresh token rotation
* Social logins
* Managing your Auth0 account

> **Look for the 🛠 emoji if you’d like to skim through the content while focusing on the build and execution steps.**


## Add Refresh Token Rotation

When the app makes an authentication request to Auth0’s authentication server, it includes the `offline_access` scope. This causes the authentication server to issue a refresh token, which the app can use to re-authenticate without requiring the user to log in again. The app stores this token in the device’s secure storage.

While this enhances the app’s user experience, it also introduces risk. The refresh token is long-lived, and the app could use it as a “lifetime pass” to endlessly request new access tokens and keep the user logged in forever.

I highly recommend taking advantage of *Refresh Token Rotation* and *Automatic Reuse Detection* to help mitigate this risk. With these features enabled, each refresh token can be used only once. When the app exchanges its refresh token for a new access token, the authentication server also returns a new refresh token and invalidates the old one. 

Let’s enable these features!

🛠 Navigate to the **Applications** section of your Auth0 dashboard, select the **MJ Coffee** application, and then select its **Settings** tab. Scroll down the page to the **Refresh Token Rotation** section and turn on the **Rotation** and **Absolute Expiration** options:

![Turn on the “Rotation” and “Absolute Expiration” options.](https://images.ctfassets.net/23aumh6u8s0i/6EizPZZnkGjxoAOle1Q8eL/e06c99f4a49413572736bbf0f470436c/rotation_and_absolute_expiration.png)

It is recommended that you issue a refresh token that expires after a preset lifetime. The refresh token’s lifetime can be extended each time one is used to get a new access token or access token/refresh token pair.

There are two options for token lifetimes, and they can be set independently of each other:

- **Absolute Lifetime:** Enabling **Absolute Expiration** sets a specified *absolute lifetime* for the application’s refresh tokens. Refresh tokens can be exchanged for new access tokens during this lifetime. Once the token’s age goes past its lifetime, the user will need to re-authenticate in order to get a new access token. If **Absolute Expiration** is disabled, the refresh token has an indefinite absolute lifetime.
- **Inactivity Lifetime:** Enabling **Inactivity Expiration** specified *inactivity lifetime* for the application’s refresh tokens. Refresh tokens can be exchanged for new access tokens if the user is active in the application during this lifetime. If the user is inactive in the application for a period longer than the inactivity lifetime, they will need to re-authenticate in order to get a new access token.

🛠 Scroll to the bottom of the page and click the **Save Changes** button:

![The “Save Changes” button. The user is directed to click it.](https://images.ctfassets.net/23aumh6u8s0i/7KsLW4adJ6PNIPAI12al4g/f2c0e8abf6d7377595cfb7df11493e67/save_changes.png)


## Social Logins

These days, it's pretty common to have login methods beyond the standard username/password combination. These include logging in with social media account, which will significantly enhance your users’ experiences.

Implementing these additional login methods and adding them to your authorization server is time-consuming and will come with many considerations and risks. 

Luckily, Auth0 provides lots of integration with well-known third parties’ authentication systems, and even allows you to write your custom connections. Let's add connections to both Google’s and Apple’s authentication systems.


### Create a Google/Gmail social connection

🛠 In the Auth0 dashboard, select **Authentication** in the left column menu, then select **Social**. This takes you to the **Social Connections** page, where you should click the **Create Social Connection** button:

![The steps to create a new social connection in Auth0](https://images.ctfassets.net/23aumh6u8s0i/61w1eXrbY7bGOpNo6ODbaU/da810c63bacd28cabf71e6dee4baa349/create_social_connection.png)

You will be taken to the **New Social Connection** page, which has a list of social login providers that integrate with Auth0. 

🛠 Select **Google**:

![Selecting Google from all the available social connections](https://images.ctfassets.net/23aumh6u8s0i/2YdUxIkwmCTcc9QFlo584q/22f7fd0bf4bc1c93c4ebc555e21009f8/select_google.png)

You will now be on the  **New Google / Gmail Social Connection** page, which tells you what kind of user information is accessed by Google social login.

🛠 Click **Continue**:

![Initial page for creating a new Google/Gmail social connection](https://images.ctfassets.net/23aumh6u8s0i/2SQwtF0vqtXJucnGbE3DNS/baf5bd9d7103a6ecbd59b879bbe2aaf4/click_continue.png)

A new page with a number of fields will appear; this is the connection’s **Settings** tab. 

As long as you’re working in a development environment, you only need to fill the **Name** field (which provides a name for this connection) and leave all the other fields empty. You can always use the default value in the **Name** field:

![New Google/Gmail social connection](https://images.ctfassets.net/23aumh6u8s0i/7Jzsn4ryILOOdACN2urlSo/fdaa205ef09352c0b9aba0acbd592977/new_google_gmail_social_connection.png)

However, production apps require you to provide a **Client ID** and **Client Secret** ([doc](https://auth0.com/docs/connections/social/google)) and specify the **Allowed Mobile Client IDs**. These topics will be covered in another video or article.

🛠 Create the Google/Gmail connection by scrolling to the bottom of the page and clicking **Create**:

![Creating the Google/Gmail connection](https://images.ctfassets.net/23aumh6u8s0i/4S8AJUaj4xehVwVxhNDt5X/69eb88b8bec557d310d0e9d678fe9b7e/click_create.png)

This will create the connection, and you’ll be taken to its **Applications** tab. You’ll see a list of your applications, which will allow you to enable the Google/Gmail connection for any of them. Enable the connection for the *MJ Coffee* application:

![The Google/OAuth2 applications tab](https://images.ctfassets.net/23aumh6u8s0i/681u1RRcha4ABJJ5GRZivy/c7eea90ca4e19ec5ab3b333caa47e5ba/google-oauth2_applications_tab.png)

You may also set more permissions that the end-user will need to approve during authorization. These permissions depend on your application and what you want to do on behalf of the user. The *MJ Coffee* app doesn’t need any extra permissions beyond the basic and extended profile.

![Google Permission](https://images.ctfassets.net/23aumh6u8s0i/13CvLX8tQUTuqU6jpZ6K94/a0eaac13b8fc83fc11b3ca3f6651ebd9/google_permissions.png)

🛠 Make sure you sync user profile attributes at each login and hit the **Save** button.


### Create an Apple ID social connection

🛠 Once again in the Auth0 dashboard, select **Authentication** in the left column menu, then select **Social**. This takes you to the **Social Connections** page, where you should click the **Create Social Connection** button:

![The steps to create a new social connection in Auth0](https://images.ctfassets.net/23aumh6u8s0i/1sohaZxDHuq8X8ZvT5nhvE/d2b7a7e2647708327f8fc6971ddb43a9/create_connection.png)

🛠 This time, select **Apple**:

![Selecting Apple from all the available social connections](https://images.ctfassets.net/23aumh6u8s0i/3JAgbtDSNOsfYrjxkE1wCI/e51d80f7418706c29cd6e9dc06b93719/select_apple.png)

You will now be on the  **New Apple Social Connection** page, which tells you what kind of user information is accessed by Apple social login.

🛠 Click **Continue**:

![Continue](https://images.ctfassets.net/23aumh6u8s0i/3zt2ntLwoHwp6bldLmOOsD/8db3e7f5c057d5782c7202b748013420/click_connect_-_apple.png)

As long as you’re working in a development environment, you can leave the **Client ID** and **Client Secret Signing Key** fields empty. You *will* need proper keys for those fields when the app goes to production; [this document covers that topic in more detail](https://auth0.com/docs/connections/apple-siwa/set-up-apple).

The **Apple Team ID** and **Key ID** values are required:

![Google Permission](https://images.ctfassets.net/23aumh6u8s0i/2qNvT5zkxB1TY06ywkH5Re/7c46fa1399743de9e7bb05d1d804fab0/apple_dev.png)

* To get your Apple Team ID, you need an Apple Developer Account.
* To get a Key ID for your app, you need to register that app using your Apple Developer Account. 

🛠 Sign in to your Apple Developer Account, and go to the **Membership** page and make a note of your Team ID.

🛠 If you have a registered app, you can skip the following steps and jump to the list of tasks for creating a service ID. Otherwise, follow the steps below:

- In the Apple Developer Portal, go to **Certificates, IDs, & Profiles > Identifiers** and click the blue “plus” icon next to **Identifiers** to create a new App ID.
- Choose **App IDs** as the identifier type and click **Continue**.
- Provide a description and a Bundle ID in reverse-domain name format (e.g.: `com.mydomain.mjcoffee`).
- Scroll down and check **Sign In with Apple**.
- Click **Continue**, and then click **Register**.

🛠 Once the app is registered, it’s time to create a service ID:

- Return to the **Certificates, IDs, & Profiles** section, and click the blue “plus” icon next to **Identifiers**.
- Choose **Service IDs** and select **Continue**. Fill in the description and identifier (e.g.: `com.mydomain.mjcoffee`).
- After checking **Sign In with Apple**, select **Configure**, and define your Web Domain (e.g.: `com.mydomain.mjcoffee`) and your "Return URL". Ensure that your Return URL is your Auth0 domain and that it follows this format: `https://YOUR_AUTH0_DOMAIN/login/callback`.

![Return URL apple sign in](https://images.ctfassets.net/23aumh6u8s0i/5Wetff0Tutv55UXsYz0gKq/ab19cd3e48604aea314410d22d194982/callback_apple.png)

🛠 Finally: save, continue and then register the service.


#### Set up your Client Secret Signing Key

🛠 Follow these steps:

- Go to **Keys**, which is located in the **Certificates, Identifiers, & Profiles** section of your Apple developer dashboard.
- Select the blue “plus” icon to add a new key.
- Enter a **Key Name** and check the **Sign In with Apple** option.
- Select **Configure** to make sure the **Choose a Primary App ID** field is filled with the correct App ID.
- Select **Save, Continue**, and then **Register**.
- On the page to which you're redirected after registering, make a note of the Key ID. Then download the key; it will have a `.p8` filename extension.

🛠 Go back to your Apple social connection settings and paste the Key ID. Ensure the proper attributes are selected (Name, Email) and sync user profile at each login is enabled. Hit **Save**.


## Enable Social Connections

🛠 Once you have created all your social connections and set them up correctly, go back to your applications. Go to the **Connections** tab and enable your newly-made social connections:

![app social connections](https://images.ctfassets.net/23aumh6u8s0i/59SCRbiX055qDcmTSNwPVl/fa175f974ceb43515893f24f7747d549/app_social_connections.png)

As you can see, adding and removing social connections for your apps is now as simple and flicking a switch.

On the Flutter side, I have good news: you don’t need to implement anything there! 

Restart the app, log out, then try to log in. You’ll see this:

![app social connections](https://images.ctfassets.net/23aumh6u8s0i/4b6BIaeZ8EHcN1a3MYVOrF/91c9039cf0d56051c99397d1a7524a3e/social_buttons_flutter.png)

That's it! The login screen will now display social login buttons, and their login flows will be ready to use.


## Branding 

While it’s fine to use the default branding in development, you want the login page to be customized to your “look and feel” once the app’s in production.

Auth0 allows you to customize your login page through a number of options. You can change the look and feel of the login page by adding colors and logos, and you can customize the user notification part of the process as well: email templates, text messages, and so on. It’s all in the **Branding** section of the Auth0 dashboard:

![Auth0 branding](https://images.ctfassets.net/23aumh6u8s0i/7oq6VzFQ3nSUcStZTXvjQu/38d1e272f3bef751d9feaca704d580dc/branding.png)


### Add Roles

You may want to provide certain functionalities to the user based on their roles. This is easy with proper authorization server such as Auth0, which facilitates adding roles and specifying what users in each role are allowed to do. 

In the MJ Coffee app, there are three different roles:

- **Admin:** These are administrators, and they will have access to all the app’s functionality with full permissions.
- **Customer:** This is the default role for registered or logged-in users. They are limited to the app’s customer-facing features. You will automatically assign this role to all users upon registration or login, and you will learn how to do so later on in this tutorial.
- **Employee:** These are coffee shop employees. They can access the community screen to answer customer requests in the support chat, as well as other employee-facing features.

![Auth0 roles](https://images.ctfassets.net/23aumh6u8s0i/7nVdiU86TPCF1tLXrBg6ID/54a078bfe7d2382a6776c26adfc5cba4/roles.png)

You can add more roles to the app as the need arises.


## User Management in Auth0

Auth0 provides the infrastructure to store users and their information on its cloud database.

For the *MJ Coffee* app, Auth0’s cloud database is sufficient. One of Auth0’s goals is to reduce the cost of extra infrastructure maintenance and cost.

You can access users by selecting **User Management** in the left column menu of the Auth0 dashboard. The **Users** page allows you to create new users and manage your existing ones by changing their details, adding permissions and roles, or revoking their access.

![Auth0 users](https://images.ctfassets.net/23aumh6u8s0i/3O0JDGBqXHmPfrKaEavP2D/260c804cf50a308e696ecd9a446ab4a9/users.png)

When you open a user, you’ll see that Auth0 provides in-depth details about that user, including basic account data, metadata, their devices, and their history, which might be pretty helpful for debugging the application or investigating a particular user’s access activity, permissions, and roles.

![Auth0 user roles](https://images.ctfassets.net/23aumh6u8s0i/JcGTMspZ9hKtu9RAi4Oq9/257a692aa9a65cd12e96f645b56aafd1/user_roles.png)

Each user account stores some basic information about the user: name, email address, the date and time when the account was created, and so on. 

Additional information can be attached to a user by adding to these metadata stores:  their user metadata, which is a key-value structure for storing information about the user. You can also store information in the user_metadata or manipulating `app_metadata`, which helps to provide more information to the Flutter application while receiving user details.


## Moving Forward

In the next section of this tutorial, you will learn how to add real-time chat to the app.


Flutter Authentication and Authorization with Auth0, Part 2: Refresh Tokens, Social Logins, and More

Flutter Authentication and Authorization with Auth0, Part 1: Adding Authentication to an App

1Vitor de Sousa_Auth0

As Regional Vice President, Vitor de Sousa supports Okta and Auth0's German customers in achieving their Identity and Access Management goals. With more than 20 years of experience in the consumer goods industry, as well as in technology and software sales, he develops strategically smart and creative solutions for the interplay of identity authentication, customer experience, and data protection.

Regional Vice President, Enterprise Sales - Germany

Vitor de Sousa

Partnering with a provider to centralize identity lets you maintain control over your data without compromising user experience

Consumers expect the web apps and services they use to be intuitive while also requiring secure and private transactions and a low-friction experience. A good example of this is the increasing demand for biometrics, the use of a person’s physical attributes like a fingerprint or face scan to prove identity and control access. Consumers have become accustomed to the security and convenience that using a fingerprint to unlock their smartphone offers, so using the same technology to secure your web app is an intuitive way to help secure their account data.

[Auth0’s recent global survey](https://info.auth0.com/erwartungen-und-realitat.html), including more than 2,000 consumers and 200 IT/marketing decision-makers in Germany, found that 31% of German consumers are more likely to sign up for a service if it offers biometric authentication. Yet only 17% of German businesses offer this feature. SO biometric authentication is one way for businesses in the DACH region to better align themselves with their customers’ expectations for security without compromising their customer experience (CX). 

Partnering with an [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider who understands how to combine an intuitive user interface with strong security measures like that offered by biometrics can bring additional benefits to your organization. For example: freeing your in-house development talent to focus on your core product, helping you meet regional data privacy regulations, and maintaining active control over your user data.

## Let Your Internal Talent Focus on Your Core Product

Germany is not only the largest economy in the EU; it is also home to the largest software developer talent pool in the region. [As of 2019](https://www.cbi.eu/market-information/outsourcing-itobpo/software-development-services/market-potential), there were more than 900,000 developers in the country, with a majority describing themselves as [Full-Stack front-end developers](https://insights.stackoverflow.com/survey/2021). To ensure your in-house dev teams can focus on those strengths, don’t distract them with an identity project. At Auth0, identity is our core product. Our teams built, maintained, and enhanced a Customer Identity and Access Management (CIAM) platform that incorporates industry security standards, an expert understanding of regional data privacy regulations, and a highly customizable set of integrations to bring you exactly the right mix of security, privacy, and CX.

Our identity specialists bring their expertise and knowledge to secure your authentication and authorization processes while also bringing your customers the tailored, low-friction CX they expect. That allows us to help you build a solution that will be capable of incorporating your needs in the present — while remaining extensible enough to scale with your plans for the future. 

The centralized identity solution you build will unify authentication for your platforms, services, and web apps. This single source of truth (SSoT) for your customer identity data is easier to secure than disparate, siloed data stores for each system. It also limits your attack surface by eliminating multiple access points and login boxes. 

By partnering with Auth0, you get a centralized identity platform that’s ready to be customized by your developers to meet your precise requirements. And our extensibility allows that platform to be readily extended to cover all of your existing properties, whether they’re modern cloud-based apps or legacy on-prem systems.

## Understanding Data Privacy Regulations in The DACH Region

EU Member States are allowed to enact national privacy rules to supplement, specify, and modify the GDPR rules as applied to their citizens. It’s important that companies familiarise themselves with these rules that often govern specific situations.

This document is not intended to act as legal advice. Please consult your legal counsel to ensure you are in compliance with all applicable data privacy laws and regulations.

The right to privacy is well established and respected in the DACH region, where such legislation existed long before the GDPR. Today there are additional rules such as the new German Privacy Act (BDSG-new) along with industry-specific regulations for, e.g., telecommunications, banking, and energy. In Austria, too, we see local regulations like the [Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (DSG)](https://www.dataguidance.com/notes/austria-data-protection-overview), all designed to put the privacy rights of citizens first.

[Switzerland](https://www.dataguidance.com/notes/switzerland-data-protection-overview) has a slightly different take on data protection regulations as well. In addition to GDPR, there are two additional laws that impact data collection and processing there. The first is Article 13 of the Swiss Constitution, which protects Swiss citizens’ rights to privacy in personal and family life, as well as within the home. Meanwhile, the Federal Act on Data Protection (FADP) solidified the language governing how those rights are protected in regards to digital data. Unless you have a team of lawyers and governance specialists for your developers to work with, making sure you’re in full compliance with all of these regulations will soak up a lot of internal resources. Partnering with an IDaaS provider can alleviate these additional strains by taking on the task of helping to assure compliance.

The DACH data privacy landscape can seem complex, and the responsibility for coding privacy into your applications often falls to the people building them. By partnering with Auth0, your developers can help you protect your customer’s personal information without becoming privacy experts themselves. Auth0’s key privacy-enabling features include:

* Easy access to user profiles to enable removal requests
* To export a user’s data in JSON format for data portability
* To enable Log Streaming for continuous security monitoring
* The knowledge that your data is stored locally at an AWS facility in Frankfurt

## Great Customer Experience Includes Choices for Data Location

Part of ensuring your customers get the experience they expect is maintaining control over the data they share when they create an account. Consolidating that data into an SSoT simplifies continuously monitoring its security and detecting threats and other anomalies. Having choices with respect to the location where your data is stored is another asset of partnering with an IDaaS provider like Auth0.

### Data security certification

Auth0 brings knowledge of [regional privacy regulations](https://auth0.com/docs/compliance/gdpr), along with internationally recognized certifications from organizations such as the International Standards Organization (ISO) [27001](https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en) and [27018](https://www.iso.org/standard/61498.html), along with a[ SOC 2 Type II audit](https://auth0.com/blog/auth0-achieves-soc-2-certification/). These are third-party verified certifications, meaning a specialized auditing body has signed off on the security of our processes, infrastructure, [platform](https://assets.ctfassets.net/kbkgmx9upatd/2KxmM5BICQ4GKgeIwA0sKu/d4f59bd579803593edcd571f1aa92ef0/Auth0_Platform_Operations.pdf), policies, and continuous monitoring framework. Auth0 complies with [additional regulations](https://auth0.com/de/security) as well, BaFin, EBA, and HIPAA for example. 

### Customizable user interfaces

[Auth0 Marketplace](https://marketplace.auth0.com/) offers integrations with major line-of-business software, while our [Actions](https://auth0.com/actions) capability allows your developers to work with these integrations with everything from drag and drop to a full Javascript editor. This ease of integration and customization means you can create your login box once and use it across properties.

### All your user data in one place

Being cloud-native gives Auth0 the flexibility to offer multiple data storage options. Access is a key piece of data residency. For organizations in the DACH region, we offer [private cloud deployment options on Microsoft Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) or AWS infrastructure, as well as public cloud options using an AWS facility in multiple regions such as Frankfurt to help our customers achieve compliance. 

### Iterative deployment to ensure buy-in across the organization

Deploying a new identity and access management system can be a lengthy and complex process from a business perspective. Partnering with Auth0 and taking advantage of our identity experts allows for an iterative deployment and a smooth migration that does not jeopardize the user experience by offering frictionless user migrations without password resets. That way, each department or product team can witness a successful roll-out before giving their buy-in without straining your in-house talent. Cross-departmental collaboration is key to any software project, particularly when that software controls data access, and having a successful proof-of-concept (POC) in hand can help secure buy-in as you move forward.

Work with an identity partner that understands your need for a great digital experience without compromising the security and privacy of your customer data. [Reach out to our identity experts](https://auth0.com/contact-us) when you’re ready to continue the conversation or to find out how to start working with Auth0 today.


Centralize Identity For Security and Customer Experience

agustina-ruiz

As Latam Public Relations Manager, Agus supports the public relations and global communications efforts for Auth0 in the Latam region. In her personal time, she is a proud mother of three and has many hobbies such as cooking, skiing and pottery among others.

Public Relations Manager - LATAM

Agustina Ruiz

Leading LATAM identity providers support Mexico’s top companies with identity management and security needs

**BUENOS AIRES, Argentina – Nov. 17, 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), announced today a new partnership with [TEC360](http://www.tec360cloud.com/), a leading provider of cloud solutions for enterprises in Mexico and Latin America (LATAM). TEC360 is Auth0’s first partner in Mexico, and together, the two companies are helping enterprises across the region meet their evolving identity management and security goals.

TEC360 operates in Mexico and LATAM and provides cloud solutions for enterprises’ technological and security needs including customer experience (CX) and employee experience (EX), change management, edge infrastructure, identity management, and internet of things (IoT). The addition of TEC360 to Auth0’s [Partner Program](https://auth0.com/partners) and Auth0’s growth in the region indicates the growing demand and importance of identity management in securing the new and complex digital world as businesses have to meet the ever-growing expectations for security, privacy, and convenience.

Globally, the pandemic has [accelerated digital road maps across industries](https://auth0.com/blog/how-brick-and-mortar-approaches-improve-digital-experiences/), and businesses now have to quickly respond to changes in digital expectations and buying patterns — and in LATAM the technology penetration has been rapidly growing at an average rate of 65% year-over-year since 2003 ([2020 Latin America Digital Transformation Report)](https://www.atlantico.vc/latin-america-digital-transformation-report), with Mexico as the second-highest country in LATAM, following Brazil. As the number of online identities continue to increase, so do the number of online threats — a modern identity platform offers the right balance of convenience, privacy, and security to protect and retain customers.

“At TEC360, our commitment is to provide enterprise customers with the best cloud solutions that give their organization and customers more choice and flexibility to accelerate growth and innovation,” said Peter Wiegandt, CEO of TEC360. “Identity management is a critical part of these projects, and by joining forces with Auth0 we will give our customers in Mexico and throughout LATAM the extensible building blocks to solve for an identity use case without having to compromise between convenience, privacy, or security.”

“More than ever, a modern identity solution can help accelerate digital transformation, remove security risks, and positively impact the business through improved user experiences,” said Ghazi Masood, SVP and General Manager, Americas at Auth0. “We are proud to join forces with TEC360 to help customers in the region customize identity for their exact use case, enabling them to free up time and resources previously spent on the complexities of identity management to focus more on their core value proposition.”

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Grupo Muchnik PR for Auth0 <br />
[auth0@muchnik.co](mailto:auth0@muchnik.co) <br />

### Investor Contact
Investor Relations <br />
[investor@okta.com](mailto:investor@okta.com) <br />

Auth0 Expands Reach to Mexico with TEC360 Partnership

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Global identity management provider supports the launch of Ivy League MBA interactive learning platform

**BELLEVUE, Wash. – Oct. 28, 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced it has been selected as the identity and authentication provider for [Wharton Interactive](https://interactive.wharton.upenn.edu/), an interactive learning platform that draws on games, simulations, and research to make Ivy League business education more accessible to all. To enable a seamless, end-to-end experience for learners and educators, Auth0’s platform will provide a [Single Sign-on](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) (SSO) solution for learners and educators throughout their journey.

Wharton Interactive — founded by Sarah Toms, executive director, and Professor Ethan Mollick at the Wharton School, The University of Pennsylvania — has developed different modes of delivering education on its Alternate Reality Courseware (ARC) platform. ARCs knit together leading subject matter expertise and an immersive games-based experience where users gain mastery through practice and receive personal feedback about their performance every step of the way. By increasing inclusive access to business education, this unique higher ed initiative strives to better the socio-economic status of individuals and lift economies through job creation.

To aid in Wharton Interactive’s marketplace launch, the team wanted to create one, seamless user experience across the entire platform, from the user’s account creation and management to the interactive simulations and classes, and selected Auth0 to help. By implementing SSO, students and educators can enter their login credentials once and automatically gain access to multiple applications. Through the implementation of Auth0’s SSO solution, Wharton Interactive’s platform benefits from increased security and privacy while improving the end-to-end experience for users.

“Auth0 plays an integral role in making Wharton Interactive’s mission to transform education a reality by eliminating the hurdles associated with having to login to multiple systems along the customer journey,” said Sarah Toms, co-founder and Executive Director for Wharton Interactive. “We were searching for a top-notch identity provider with proven expertise in SSO, and are so pleased that we have partnered with Auth0. From vendor selection to launch, it took only a few months to build and deliver a comprehensive solution that was ready for market.”

“Wharton Interactive is democratizing higher education and transforming the eLearning space with its cutting-edge approaches, and identity is a key enabler in supporting this mission — strong user experience, security, and privacy practices all start at login,” said Ghazi Masood, General Manager and SVP of Americas at Auth0. “We’re honored to support Wharton Interactive’s identity needs and help them seamlessly scale as they make education more attainable and secure for educators and learners around the world.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter Communications for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

### Investor Contact:
Investor Relations <br />
[investor@okta.com](mailto:investor@okta.com)

Wharton Interactive Selects Auth0 to Help Securely Democratize and Transform Education

Flutter Authentication and Authorization with Auth0, Part 4: Roles and Permissions

Flutter Authentication and Authorization with Auth0, Part 3: Adding Real-Time Chat to the App

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Enhanced identity management for builders and providers of B2B SaaS applications enables faster implementation and best-in-class security, branding, and administration

**BELLEVUE, Wash. – April 26, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Organizations](https://auth0.com/organizations), a purpose-built feature enabling providers of B2B SaaS applications to seamlessly manage their business customers—a use case Auth0 defines as Business Customer Identity. Organizations is Auth0’s enhanced way for enterprise app teams to manage customers and partners in any multi-tenant, B2B, or SaaS application. With Organizations, B2B implementations are less complex, enabling faster speed-to-market and a better overall experience for business customers and partners. 

Business Customer Identity remains largely unaddressed by today’s Workforce Identity and Customer Identity Access Management (CIAM) solutions, forcing those who build and deliver B2B SaaS applications to cobble together features to address their unique use case. This requires significant customized configuration leading to high ongoing maintenance and configuration costs, slower time to market, and more difficult use case expansion and new app development.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5AGLt3QorElIYSuC43J2TE/c3db1cfffa3649353fab74e01dcdd511/approved-asset-three.jpg)

Business apps are not just used by individuals but by teams and entire companies, all of which need easy and secure onboarding, flexible membership provisioning, access control, and SSO setup. Convenience for B2B users is also increasingly in demand, prompting enterprises to provide similar seamless experiences to business partners as they do for consumers. Auth0 Organizations solves all of these issues and more, offering customizable identity management of any business customer or partner.   

Key benefits of Auth0 Organizations include: 

* **Simple Business Customer Onboarding:** Auth0’s APIs and SDKs can easily model entire business organizations, and rapidly-implemented admin dashboards manage SSO, Role-Based Access Control, and flexible user management workflows.
* **Custom-Branded Federations:** The ability to customize the login experience with branded login and registration flows ensures that business customers feel at home. 
* **Faster, Easier Deployment:** Less complex implementations shorten time to market, and integrations are accelerated as new products are built or acquired. 
* **Identity Engineering & Maintenance Costs Reduction:** Engineering resources can shift to work on core product innovation instead of focusing on complex identity issues.

“We were initially looking for a platform solely to handle SSO for our enterprise customers. Organizations is a great fit and offers enough flexibility to replace authentication for our 300+ non-enterprise customers, too,” said Steven Easton, Lead Engineer at Amiqus. “We’ve been really impressed with how powerful Auth0 is and yet have barely scratched the surface. We are excited to roll out Organizations as an improvement to our business customers’ experience and value how easy Auth0 makes it to do so.”

“We see Business Customer Identity as a standalone use case, one that our customers have increasingly been confronted with and had trouble fully addressing—until now,” said Shiv Ramji, Chief Product Officer at Auth0. “B2B identity management represents a sizable portion of our business and is consistently growing, demonstrating the need that Business Customer Identity addresses. We are thrilled to launch Auth0 Organizations as our next-generation offering for easy onboarding, authentication, and administration of business customers.”

More information can be found at [Auth0 Organizations](https://auth0.com/organizations).

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Launches Organizations, Transforming the Way Enterprises Manage Business Customer Identity

Global identity management provider recognized for commitment to government, education, and nonprofit customer success

**BELLEVUE, Wash. – April 14, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has joined the [Amazon Web Services (AWS) Public Sector Partner (PSP) Program](https://aws.amazon.com/partners/public-sector/). The AWS PSP Program recognizes AWS Partner Network (APN) Partners with solutions and experience in delivering government, education, and nonprofit customer missions around the world.

Auth0 and AWS are teaming up to help serve public sector customers in solving their unique security, privacy, and user experience challenges to meet mandates, reduce costs, drive efficiencies, and accelerate innovation. As an AWS Public Sector Partner, Auth0 now offers its extensible authentication and authorization solutions to the public sector community on the AWS Marketplace. To be selected for the program, Auth0 had to meet pre-defined criteria, including deep expertise and commitment to delivering government, education, and nonprofit services on a global basis. 

“We are honored to join the AWS PSP Program—this recognition reflects Auth0’s commitment to helping the global public sector community,” said Bill Lapcevic, VP of Business Development at Auth0. “As a Public Sector Partner, we are enabling public sector customers to accelerate their business growth on AWS, and are in a unique position to help these customers achieve their cloud security goals as they scale.”

In addition, Auth0 announced the appointment of Dean Scontras, Senior Director of Public Sector Sales, to lead the company’s federal, state, and local business and sales strategy.

“For the public sector, in particular, the onset of COVID-19 has accelerated the transition to digital citizen services, and heightened the need for organizations across all industries to secure their valued assets and data more firmly,” said Scontras. “I’m honored to join the Auth0 team and aid the company’s continued efforts in helping government agencies at the local, state, and federal level as they move towards digital citizen services and the essential role identity will play in that move.” 

Auth0 is an AWS Advanced Technology Partner that is participating in [AWS Public Sector Summit Online](https://aws.amazon.com/events/summits/online/public-sector/?did=ep_card&trk=ep_card), taking place April 15, 2021. To learn more, visit: [https://info.auth0.com/auth0-at-aws-publicsectorsummit-2021.html](https://info.auth0.com/auth0-at-aws-publicsectorsummit-2021.html)

Auth0 achieved the [AWS Security Competency](https://auth0.com/blog/auth0-achieves-aws-security-competency/) status in 2020 and was one of the first AWS Partners to give AWS customers seamless access to [professional services in AWS Marketplace](https://auth0.com/blog/auth0-supports-the-launch-of-professional-services-in-aws-marketplace/). For more information, visit [Auth0’s AWS Partner page](https://partners.amazonaws.com/partners/001E000000YKGRTIA5/Auth0). 

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Joins the Amazon Web Services Public Sector Partner Program

Global identity management provider recognized as a top IT cloud management product



**BELLEVUE, Wash. – Feb. 17, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it was recognized on G2’s Best Software for 2021 list. The list ranks software companies and products based on G2’s thorough vetting process of verified user reviews of groups of similar products. Auth0 ranked #13 on the ‘[IT Cloud Management Products](https://www.g2.com/best-software-companies/top-it-management)’ list, based on its high levels of G2 user ratings for customer satisfaction and likeliness to recommend.  

G2 created the list based on data from over one million authentic, verified customer reviews. Winners were determined based on reviews left at G2.com between Jan. 1, 2020, and Dec. 31, 2020. All scores were calculated using G2’s algorithms, including for Satisfaction and Market Presence, explained in detail [here](https://www.g2crowd.com/static/g2_grid_scores). 

“Identity is essential and is a long-term business enabler&mdash;we are proud to help our customers around the globe meet their identity management and security goals by providing a trusted, extensible way to handle identity,” said Holly Files, SVP of Customer Success at Auth0. “We are grateful for our customers’ feedback and G2’s recognition of Auth0, and are honored to be recognized on the list along with companies like Amazon, Hashicorp Terraform, and IBM.”

“This isn’t a subjective list based on a few peoples’ opinions,” explains G2 CEO Godard Abel. “With the highest traffic and engagement, largest selection of products and services, and highest quality data, G2 analyzes more than four million data points to determine which products and companies make the list.”

Auth0 is a G2 Leader ranking in five categories: [Customer Identity and Access Management (CIAM)](https://www.g2.com/categories/customer-identity-and-access-management-ciam), [Identity Access Management (IAM)](https://www.g2.com/categories/identity-and-access-management-iam), [Single Sign On (SSO)](https://www.g2.com/categories/single-sign-on-sso), [User Provisioning and Governance](https://www.g2.com/categories/user-provisioning-and-governance-tools), and [Multi-Factor Authentication (MFA)](https://www.g2.com/categories/multi-factor-authentication-mfa). Learn more about what real users have to say (or leave your review of Auth0) on G2’s [Auth0](https://www.g2.com/products/auth0/reviews) review page.

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />


Auth0 Ranked on G2’s 2021 Best Software Companies List

Global identity management provider one of the first AWS Partners to give AWS customers seamless access to professional services in AWS Marketplace



**BELLEVUE, Wash. – December 3, 2020** – The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it is participating in the launch of Professional Services in AWS Marketplace. Amazon Web Services (AWS) customers can now find and purchase professional services from Auth0 in AWS Marketplace, a curated digital catalog of software, data, and services that makes it easy to find, test, buy, and deploy software and data products that run on AWS. As a participant in the launch, Auth0 is one of the first independent software vendors to quote and contract services in AWS Marketplace to help customers implement, support, and manage their software on AWS. [Click here](https://aws.amazon.com/marketplace/seller-profile?id=0079abaf-bc2f-481c-9543-d2bfedb81003) for more information. 

As organizations migrate to the cloud, they want to use their preferred software solutions on AWS. AWS customers often utilize professional services from Auth0 to help implement the Auth0 platform and enable interoperability with their applications. Until now, AWS customers had to find and contract professional services outside of AWS Marketplace and could not acquire an identity platform solution and associated professional services in a single procurement experience. With professional services from Auth0 available in AWS Marketplace, customers have a simplified way to purchase and pay for both their subscription to the Auth0 platform and related professional services in a centralized place. 

“Auth0 is proud to offer professional services in AWS Marketplace and provide AWS customers with additional support they may need for any identity implementation,” said Bill Lapcevic, VP of Business Development at Auth0. “We are excited to be one of the first independent software vendors to offer professional services as part of this launch and look forward to providing an even more comprehensive identity offering for AWS customers.”

Auth0 is an AWS Advanced Technology Partner that is participating in AWS re:Invent 2020, taking place November 30 - December 18, 2020. To learn more, visit: [https://info.auth0.com/auth0-at-aws.html](https://info.auth0.com/auth0-at-aws.html). 

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />


Auth0 Supports the Launch of Professional Services in AWS Marketplace

Global identity management provider recognized as one of the fastest-growing companies in North America for second consecutive year



**BELLEVUE, Wash. – November 18, 2020 –** [Auth0](http://www.auth0.com/), the identity platform for application teams, today announced its inclusion on [Deloitte's Technology Fast 500™](https://www2.deloitte.com/us/en/pages/technology-media-and-telecommunications/topics/north-america-technology-fast-500.html) for the second year in a row. The list ranks the 500 fastest growing technology, media, telecommunications, life sciences, and energy tech companies in North America. 

Auth0's inclusion is representative of the organization's remarkable year-over-year growth since its inception in 2013, and a 70% increase in overall revenue and customer acquisition in 2019 along with continued success through 2020. Auth0 announced a [$120 million round of Series F funding](https://auth0.com/blog/auth0-helping-navigate-through-times-of-transformation/) in July that brought the company's valuation to $1.92 billion and total capital raised to more than $330 million. 

"Being included on the Deloitte Technology Fast 500 for the second year in a row is a great testament to Auth0's growth, despite the challenges that 2020 posed," said Eugenio Pace, CEO, and co-founder of Auth0. "Our placement represents the commitment and accomplishments of our entire team and the support of our loyal customers, partners, and investors. We will continue this dedication and deliver innovative solutions for the persistent problem that our technology is solving."

<include src="asides/AboutAuth0" />

## About Deloitte's 2020 Technology Fast 500™

Now in its 26th year, Deloitte's Technology Fast 500 provides a ranking of the fastest-growing technology, media, telecommunications, life sciences, and energy tech companies &mdash; both public and private &mdash; in North America. Technology Fast 500 award winners are selected based on percentage fiscal year revenue growth from 2016 to 2019.

In order to be eligible for Technology Fast 500 recognition, companies must own proprietary intellectual property or technology that is sold to customers in products that contribute to a majority of the company's operating revenues. Companies must have base-year operating revenues of at least $US50,000 and current-year operating revenues of at least $US5 million. Additionally, companies must be in business for a minimum of four years and be headquartered within North America.

## About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee ("DTTL"), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as "Deloitte Global") does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the "Deloitte" name in the United States, and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see [www.deloitte.com/about](http://www.deloitte.com/about) to learn more about our global network of member firms.

### Media Contacts

Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />
 
Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />


Auth0 Ranked on Deloitte's 2020 Technology Fast 500™ 

725ee191354be8a85ea104735c7f9264

Software Engineer, Open Source Enthusiast, Tactical & Stealth Gamer, Sport Shooter, Motor Biker, interested in InfoSec, AppSec, Linux, Cyberpunk.

Enterprise Solutions Engineer

Mathias Conradt

Learn how to add an ID4me-compliant identity provider option to an application using Auth0



## Purpose

The purpose of this sample project is to demonstrate how you can use [Auth0](https://auth0.com/) to add an **ID4me-compliant** identity provider as an option to your end-users to sign up and log in to your web application.

## About ID4me

[ID4me](https://id4me.org) is an **open, global, federated standard** to manage online identities. It allows the user to establish their identity using **their own domain name** and then use that identity to log in and sign up at websites that support ID4me.

ID4me provides full data sharing control. ID4me users are not only free to choose their identity provider, they can **change their provider at any time**. This is also what differentiates ID4me from other commonly known social identity providers in the field.

The user can also use single-sign-on across different services with just one ID, which means they don't have to remember multiple passwords for different websites.

The initiative’s mission is to provide users with open and internationally available identity services that adhere to **security and data protection standards**, that foster** user choice**, and that **avoid identity lock-ins**.

ID4me is an open group of internet service providers, software developers, and other entities that care about the future of the internet and want to defend its distributed and federated architecture when it comes to digital identities.

## About Auth0

[Auth0](https://auth0.com) is an Identity as a Platform (IDaaS) service provider.

With Auth0, you take perhaps the riskiest endeavor your engineering organization will face, managing and securing the identities of your customers and employees, and abstract away this complexity and risk with our identity platform.

Our standards-based **Identity-as-a-Service** platform is built for developers, by developers so that your engineering organization can focus on building the solutions that delight your customers and drive your revenue. Our customers find that what typically either takes months to deliver or simply cannot be delivered via internal or external solutions, takes them only days to deliver with Auth0 due to our extensive SDKs, intuitive API, extensible architecture, and our simple management dashboard.

This is why Auth0 is the leader in developer-focused identity management, with more than 7,000 customers trusting us with billions of transactions everyday.

## Prerequisites

If you don't already have an Auth0 account, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

We assume that you have an existing ID4me identity and have already chosen an identity authority (identity provider) and identity agent (claims/user information provider). If not, go to the [Identity Agent website](https://identityagent.de/register) and create one for free.

This example demonstrates the use of `id.test.denic.de` ([DENIC-ID](https://www.denic.de/en/service/denic-id/) test environment) as the user identity authority and `identityagent.de` as the identity agent, according to the ID4me specification.

## Terminology

Before we proceed, let's clarify some terminology up front.

**Relying party**

An online service that uses ID4me to validate user logins.

*In our example*: a Node.js web application, but brokered via Auth0. (So, technically, Auth0 is the Relying Party).

**Identity authority**

An online entity ensuring the correct authorization of the user at every login, by storing and verifying their authentication credentials, such as their password. It represents the “back-end” and trust source for the provision of the authorization service, but it generally does not deal directly with the user and does not store or supply the user’s personal information.

*In our example*: `id.test.denic.de`

**Identity agent**

An online entity providing the ID4me service to users. It represents the “front-end” for the provision of the authorization service, selling or supplying ID4me identifiers to users and creating them at an identity authority. It also stores the user’s personal information, communicating it to the relying parties when
the user consents, and can potentially provide the user with reports and statistics on the service.

*In our example*: `identityagent.de`

A typical ID4me authentication flow, and the parties involved, looks like this:

![ID4me authentication flow](https://images.ctfassets.net/23aumh6u8s0i/7AwYCBasmS2ZnZCwJUJKUT/47fad22d847d9dc30da9631dbd30296b/Screen_Shot_2019-09-23_at_11)

## Configuration

The flow of this authentication process is a bit different than with other custom social connection providers added to Auth0, which is grounded in the federative concept of ID4me. Because of this, our integration with Auth0 will also be a little different.

We assume that the reader is generally familiar with the concept of ID4me. If you need to brush up, you can find more details [on the ID4me website](https://id4me.org/login-partner-developer-zone).

ID4me makes use of the [*Distributed Claims* mechanism](https://openid.net/specs/openid-connect-core-1_0.html#AggregatedDistributedClaims).

The following diagram outlines the flow of the overall authentication process when integrated with Auth0:

![Auth0 id4me authentication flow](https://images.ctfassets.net/23aumh6u8s0i/K1yKqChVMFOvzOqmlUsIB/8be37ffb4960d49398f99c39cb0d9632/auth0-id4me-flow)

### 1. Create Application

Register an Auth0 client application by creating a new application within Auth0. Go to the `Applications` section in the Auth0 dashboard and click the `+ Create Application` button.

![Create Auth0 application](https://images.ctfassets.net/23aumh6u8s0i/39UxGEeZaezod3amV5dyrx/3b14c4891847bc62e7d5f5a645719b16/applications-create)

Give the application any name you'd like (such as `Auth0 ID4me Demo`) and choose `Regular Web Application` as the type.

![Auth0 application type](https://images.ctfassets.net/23aumh6u8s0i/3EINXBPwEwGlASnU68dcZV/78baf14f54307d7bf6ed8886153f3c68/Screen_Shot_2019-09-09_at_3)

Next, choose `Node.js` as the technology.

![Auth0 application technology](https://images.ctfassets.net/23aumh6u8s0i/6kFW6FMyKEqVPvHp7KOsHB/408e555b48092202cdf819cd28c9ebb3/Screen_Shot_2019-09-17_at_2)

### 2. Client Application Settings

Click the `Settings` tab of the client application.

In the application settings:

* Make sure `Application Type` is set to `Regular Web Application`.
* Set `Allowed Callback URLs` to `http://localhost:3000/callback`
* Set `Allowed Logout URLs` to `http://localhost:3000`

![Auth0 application settings](https://images.ctfassets.net/23aumh6u8s0i/3XfJdSQmO0MqWPZmGBKlsC/9a5c36474a130c429232777862872458/Screen_Shot_2019-09-09_at_3)

The Application Logo can be adjusted to your liking. It's not a mandatory field.

Take note of `client_id` and `client_secret`, you will need these later in the actual Node.js application.

### 3. Client Application Connections

Click the `Connections` tab of the client application.

Make sure that no connection is enabled here, as we'll purely rely on ID4me for this example. The `Username-Password-Authentication` connection might already be enabled, so make sure you disable it.

![Auth0 connections](https://images.ctfassets.net/23aumh6u8s0i/7BKCU2Dihn99fptcr6nWU5/1bc235c12b883ae8f3806bbbe4aa4fa5/Screen_Shot_2019-09-17_at_2)

### 4. Client Application Done

When you go back to the Applications section, the application should now be listed in the `Applications` overview:

![Auth0 applications overview](https://images.ctfassets.net/23aumh6u8s0i/66JdL8oaMMbow1GnxN9tlK/44876af1aa717467cf32649aa69c2368/Screen_Shot_2019-09-09_at_3)

### 5. Auth0 Management API Configuration

We need to grant our Node.js client application access to the Auth0 Management API.

For this, go to the `API` section of the `Dashboard`, select the `Auth0 Management API`, and select the `Machine to Machine Applications` tab in there.

Enable the `Authorized` switch for the `Auth0 ID4me Demo` application (so that it's green) and click the arrow on the right, which toggles the **Scopes** view.

Select the scopes `read:connections`, `update:connections`, `delete:connections`, and `create:connections` from the scope list.

Then hit the `Update` button at the bottom.

![Auth0 scopes](https://images.ctfassets.net/23aumh6u8s0i/1m7gdGEfOcrj1zEaUHz9Vt/1ffcd72280f235bc28d28a89e4887051/Screen_Shot_2019-09-17_at_10)

### 6. Cloning the Node.js Client Application from Github

Clone the GitHub repository for the sample Node.js client application:

```bash
git clone https://github.com/auth0-blog/auth0-id4me-sample.git
```

On your computer, switch to the folder where you checked out the project. 

```bash
cd auth0-id4me-sample-draft
```

Copy the `.env.sample` file to  `.env`:

```bash
cp .env.sample .env
```

Open the `.env` file in a text editor and adjust the values in it:

* `AUTH0_DOMAIN`: your Auth0 tenant domain (without `https://`)
* `AUTH0_CLIENT_ID`: the `client_id` from step 2 above
* `AUTH0_CLIENT_SECRET`: the `client_secret` from step 2 above

When finished, build and run the app:

```bash
npm install
npm start
```

Now open the browser and go to [`http://localhost:3000`](http://localhost:3000).

The client application is now up and running and you can test it with your **ID4me user**.

## ID4me Authentication

The user enters their `user id` in the client application, then presses the `Login with ID4me` button.

![ID4me login](https://images.ctfassets.net/23aumh6u8s0i/39z2raKukyj7zpmss7fuTW/7150a66bf86e3764ac8457ab1b847f54/Screen_Shot_2019-09-18_at_4)

The client application will redirect the user to Auth0, who in turn transparently federates the request further to the user's chosen ID Authority, in our example, Denic ID.

Here, the user ID will also be filled in so that the user is only asked to provide the password.

![ID4me login screen](https://images.ctfassets.net/23aumh6u8s0i/1KaKsR6xS9pz6y9be4dfcv/d397eef9434ebcbe48e83956a471614b/Screen_Shot_2019-09-09_at_2)

If it's the first time that the user uses the app and authenticates with ID4me, they will be asked what information they consent to share (between the ID4me authority and Auth0).

![ID4me consent](https://images.ctfassets.net/23aumh6u8s0i/4la8l7b9DbXyAooFrQaBJT/f1827e488d6dbed177e2cbf729cbdca6/Screen_Shot_2019-09-17_at_6)

Next, consent is also given to the Auth0 client application (consent to share between Auth0 an the Node.js client application).

![ID4me Auth0 consent](https://images.ctfassets.net/23aumh6u8s0i/4hHfKHKlWEUyrsdgvP8us9/09bc56486a0decf8557201792998717f/Screen_Shot_2019-09-17_at_6)

The browser redirects to the application, having received an ID token and information about the user:

![ID4me demo](https://images.ctfassets.net/23aumh6u8s0i/khJYUSUJKJZc5YLC70YbU/1d493b0734904fe9e0eddc96983cd7ca/Screen_Shot_2019-09-18_at_4)

## Auth0 Backend

### Auth0 Dashboard: Users

Let's look at the user list and into this specific user's detail after he authenticated:

![Auth0 user](https://images.ctfassets.net/23aumh6u8s0i/2UBg8JeAiFmU5HT6pNTQWk/78a98bba02bff0968623659c1e46c8c2/Screen_Shot_2019-09-17_at_2)

The user's primary identity provider is shown as `oauth2`.

![Auth0 ID4me user](https://images.ctfassets.net/23aumh6u8s0i/7Bmo6SUCGbZ0HUhni7AIyn/a500f07b12b0f361942c757513e9f81f/Screen_Shot_2019-09-17_at_2)

And the raw JSON of this user contains the ID4me identifier:

![ID4me identifier](https://images.ctfassets.net/23aumh6u8s0i/54fUG2ArZhgQFGe0GJL6H3/99e5188597fe4c1dc44a07fbfd8eef86/Screen_Shot_2019-09-17_at_2)

## ID4me Provider Backend

The following image shows the screenshots of both the User **Identity Authority** and **Identity Agent** (or User Information Provider).

The `General > Data` section at the User Information Provider (`identityagent.de` in our example):

![User identity provider](https://images.ctfassets.net/23aumh6u8s0i/5jh8GcauNjkCnavldSaqee/cd4d669896dfeb6e256bf436c41c2736/Screen_Shot_2019-08-29_at_3)

When the user clicks on the link `Identity authority dashboard`, they will get to the dashboard of `DENIC-ID`.

![identity authority dashboard](https://images.ctfassets.net/23aumh6u8s0i/79EdKJg7GlRb0M8j0PqgBs/018d9edf1c57a6104939cfc072cbc2e5/Screen_Shot_2019-08-29_at_3)

Once in the dashboard, you have various settings options to choose from, such as:

* Data Sharing
* Two-factor Authentication
* Password settings
* Account Status

![ID4me data sharing](https://images.ctfassets.net/23aumh6u8s0i/6XHwtozea2PKWp4lEZBcy6/e32ba380928177369080ec7010393bd3/Screen_Shot_2019-08-29_at_3)

![ID4me two factor auth](https://images.ctfassets.net/23aumh6u8s0i/2ROPaicMbXXNdNd2aYbk7G/698ca9aa00eb8e8adcc16ae3eccc90c5/Screen_Shot_2019-08-29_at_3)

![ID4me password settings](https://images.ctfassets.net/23aumh6u8s0i/42FXFoVsZYb1UsoP36jggb/5baff014fee2b3f24b6fcc40df531592/Screen_Shot_2019-08-29_at_3)

![ID4me account status](https://images.ctfassets.net/23aumh6u8s0i/2e5BV73fl6n0jHg2TErpry/43a8b96cae575e335912cd72f55682ef/Screen_Shot_2019-08-29_at_3)


Integrating ID4me with Auth0

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

This release will make it simple to federate authentication to identity providers that support OIDC.



**TL; DR**: OpenID Connect (OIDC) support has been released as a beta Enterprise Connection in Auth0. This release will make it simple to federate authentication to identity providers that support OIDC.

<include src="TweetQuote" quoteText="#OIDC support has been released as a beta Enterprise Connection in Auth0!"/>

## What is OpenID Connect?

OIDC is an authentication protocol, based on the OAuth 2.0 family of specifications. While OAuth 2.0 is focused on resource access and sharing, OIDC is focused on user authentication.

For example, if you sign into an application using your Google account via OIDC, Google will authenticate you and return identity information about you and the authentication performed to the application. OIDC is designed to be easy to use for federation and most modern enterprise identity providers support it, including Microsoft, Google, and Salesforce. Learn more about OpenID in this [free OIDC Handbook - eBook.](https://auth0.com/resources/ebooks/the-openid-connect-handbook?ref=blog)

## What Are We Releasing?

We released an OIDC Enterprise Connection as a beta feature for all customers with an Auth0 Developer Pro or Enterprise license. This connection will allow you to easily federate authentication to any OIDC-compliant identity providers. More specifically, any identity provider that implements [OpenID Connect Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html) and supports the `id_token` response type and `form_post` response mode.

Configuration is simple. Here is an example:

<script src="https://fast.wistia.com/embed/medias/5y6uj9or72.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:69.06% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_5y6uj9or72 videoFoam=true" style="height:100%;position:relative;width:100%"><div class="wistia_swatch" style="height:100%;left:0;opacity:0;overflow:hidden;position:absolute;top:0;transition:opacity 200ms;width:100%;"><img src="https://images.ctfassets.net/23aumh6u8s0i/2QedtR0E2gqslLKRIYJb6Z/ccaf8e20d913ba60162e11c019b7a526/swatch" style="filter:blur(5px);height:100%;object-fit:contain;width:100%;" alt="" aria-hidden="true" onload="this.parentNode.style.opacity=1;" /></div></div></div></div>
<br/>
<br/>

Auth0 uses the issuer URL to find the OpenID Provider Configuration Document, which should be located in the <Issuer URL>/.well-known/openid-configuration endpoint. In the example above, Auth0 is connecting to Azure Active Directory (Azure AD) using the OIDC connection.
  
Once it is saved and enabled, a button will appear in the login page. When clicked, the button redirects to the Azure AD login page:

![An image showing OIDC Enterprise Connection in action](https://images.ctfassets.net/23aumh6u8s0i/4SODmHkFrB51P57FB0OfEm/d83911e2d9668bec124b8e2f90216b89/oidc-enterprise-connection-in-action)

Additional settings can be configured, including:

-   Connection Display name

-   Custom logo on the login page

-   Domains to be used for Home Realm Discovery 

-   Scopes

## How Do I Get Started?

Because it is an Enterprise Connection, the OIDC connection requires an Auth0 Developer Pro or Enterprise license. You can configure the connection in the Auth0 Management Dashboard by clicking Connections > Enterprise > OpenID Connect. [For more information, check out the docs](https://auth0.com/docs/connections/enterprise/oidc) and [the OpenID Connect Handbook.](https://auth0.com/resources/ebooks/the-openid-connect-handbook?ref=blog)

<include src="TweetQuote" quoteText="Easily federate authentication to any OIDC-compliant identity providers with Auth0's #OIDC Enterprise connection"/>

This is a beta feature. We welcome your feedback. [Please comment on this post in the Auth0 Community.](https://community.auth0.com/c/auth0-beta-programs/new-oidc-connection-beta)

<include src="asides/AboutAuth0" />


OpenID Connect Enterprise Connection Enters Beta

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn about Sign In with Apple, the new identity provider announced at Apple WWDC 2019.

Sign In with Apple: Learn About the New Identity Provider

Discover how to set up and use German identity provider netID and integrate it using Custom Connections



## Purpose

The purpose of this sample project is to demonstrate how a web developer, using Auth0, can add the identity provider netID as an option for their end users to signup and login to their web applications.

![netID and Auth0 identity and authentication integration](https://images.ctfassets.net/23aumh6u8s0i/2rCEM5yhY3xoh4uYavsT0x/928c2056500c7ab57e2eb496577290e3/netid_splash-02)

[Photo by Daria Nepriakhina on Unsplash](https://unsplash.com/photos/_XR5rkprHQU)

## About netID

_**netID**_ is a European identity provider.

The European netID Foundation was founded in March 2018 by Mediengruppe RTL Deutschland, ProSiebenSat.1 and United Internet. Its aim is to establish the netID single sign-on as a European alternative to US providers. With netID, users can organize their consent to the use of internet services (opt-ins) transparently and in compliance with data protection regulations. To this end, the foundation has developed an open standard that enables users from all sectors to access all internet services of partners of the European netID Foundation with the same log-in. Right from the start which focuses the initial core market Germany, 38 million accounts covering roughly about 60% of the Germany online population are ready to be used.

- [https://netid.de/](https://netid.de/)
- [https://enid.foundation/](https://enid.foundation/)

Auth0 customers can add netID as a custom social connection alongside other social logins. netID is primarily an identity provider (IdP) focused on frictionless and secure login, rather than on bundling several services into one platform. This has security benefits, and gives consumers more visibility over how and where their data is shared. For these reasons, netID is an especially great option for companies in the DACH region (Germany, Austria, Switzerland) where consumers demand greater control of their personal information online.

## Creating a netID Service

### Prerequisites

We assume that you already have registered an Auth0 account and set up a tenant. If not, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

Also, we assume that you already have a client app setup in Auth0. If not, you can refer to the steps and screenshots [further below](#auth0-backend).

Furthermore, we assume that you have already registered a service provider account at netID. If not, [register a netID account here](https://developer.netid.de/register).

### netID configuration

To start, log in into the [netID Developer Portal](https://developerzone.netid.de/developerportal/index.html). Create a **Dienst** (service) for which you want to leverage the netID single sign-on. Select **Dienst** in the menu, click **Dienst hinzufügen** (Add service) and fill in the required details in the following screen. [Read the detailed documentation here](https://developerzone.netid.de/developerportal/dienste/dienst-anlegen.html#indexlink_help_developerportal_dienste) if you need further information.

A sample service could look like this, where the service domain (**Dienst Domain**) is the domain of your customer facing website. Also, links to data privacy information (**URL Datenrichtlinien**) and terms of usage (**URL AGB / Benutzungsbedingungen**) should be supplied:

![Creating a new netID service](https://images.ctfassets.net/23aumh6u8s0i/613X7O0cY0b684t0TopGDl/b2d30ff2f515fbb826ab06cb96437687/netid_create-service-00)

> Note: for testing purposes, you can actually enter any domain and URL values into this form, as they are not technically relevant in order to get the netID integration in Auth0 running

In the end, it should look similar to this:

![Reviewing the details in the netID developer](https://images.ctfassets.net/23aumh6u8s0i/2i1Ql13ESYhb8ZuNHHSTD8/f7625c39badb7588defa49a7ad65dfc7/netid_create-service-01)

Create a **Client** for this service by clicking on **Client hinzufügen** (Add client). [Detailed documation on how to do this](https://developerzone.netid.de/developerportal/clients/client-anlegen.html#indexlink_help_developerportal_clients) is available in the [netID Developer Portal](https://developerzone.netid.de/developerportal/index.html). It's critical to set the proper Auth0 callback URL for your tenant. The Auth0 Callback URL is `https://<tenant>.auth0.com/login/callback` where `<tenant>` needs to be replaced with your Auth0 tenant name.

Sample configuration:

![Sample configuration for a netID client](https://images.ctfassets.net/23aumh6u8s0i/4gDaCj5Acfwb2lrLi0PhVP/97d9dd32937d8247b16d0c80d5bd7abb/netid_create-client-sample)

> Note: the values here should be adjusted to your needs, especially "Callback URL", which needs to point to your Auth0 tenant and region

In the end, it should look similar to this:

![Creating a new netID client](https://images.ctfassets.net/23aumh6u8s0i/7J55Z734Wk0pArNqPALqPF/7129e9937cef20e4614fe972bc962406/netid_create-client-02-new)

Once the client is created it will initially run in a sandboxed mode, which means it can only be used with whitelisted netID-Accounts (email addresses).

In order to successfully run through the initial integration add a test user (email address) to the whitelist by selecting **Testnutzer hinzufügen** (Add Test-Account), outlined [on the developer portal](https://developerzone.netid.de/developerportal/testnutzer/testnutzer-anlegen.html). Up to 10 accounts can be whitelisted per sandboxed client.

Finally, find the **Client ID** and **netID Token - Sandbox** (later referred to as **client secret**) for the Auth0 configuration by expanding the client details, as shown in the following image:

![Viewing the client details of the netID app](https://images.ctfassets.net/23aumh6u8s0i/5yvbhrEWwtzyJFNnIQJlRk/5b8a29361be8247ef3f3e49618c6e765/netid_client-details-01-new)

## Creating a Custom Social Connection in Auth0

To configure Auth0, start by logging in to the [Auth0 Dashboard](https://manage.auth0.com/dashboard). Then, go to **Connections > Social** in the Auth0 Dashboard, scroll to the bottom, and click **Create Custom**.

Next, enter the following values into the configuration screen that appears:

**Connection Name**: `netID`

**Authorization URL**:

```
https://broker.netid.de/authorize?claims={"userinfo":{"birthdate":{"essential":true},"gender":{"essential":true},"email": {"essential":true},"email_verified": {"essential":true},"given_name": {"essential":true},"family_name":{"essential":true}}}
```

> Note: In this URL, you notice the explicit parameter `claims`. This parameter tells Auth0 which claims to ask for from netID. **Please note** &mdash; netID will ignore any data requested via standard scopes (_name, address, ..._) as well as optional/voluntary claims.

netID supports the following claims:

- `gender` &mdash; the gender of the end user
- `given_name` &mdash; first name(s) of the end user
- `family_name` &mdash; Last name(s) of the end user
- `birthdate` &mdash; Date of birth of the end user
- `email` &mdash; email address of the end user
- `email_verified` &mdash; verification status of the email address of the end user
- `address` &mdash; the end user's address
- `country` &mdash; country of the end user's address

You can adjust the claims parameter according to your needs.

**Token URL**: `https://broker.netid.de/token`

**Scope**: `openid`

**Client ID**: `<enter the ClientID you retrieved from netID>`

**Client Secret**: `<enter the Client Secret you retrieved from netID>` (previously referred to as **netID Token - sandbox**)

Copy the following JavaScript snippet into the **Fetch User Profile Script** box:

```javascript
function(accessToken, ctx, cb) {
  request.get('https://broker.netid.de/userinfo', {
    headers: {
      'Authorization': 'Bearer ' + accessToken
    }
  }, function(e, r, b) {
    if (e) return cb(e);
    if (r.statusCode !== 200) return cb(new Error('StatusCode: ' + r.statusCode));
    var profile = JSON.parse(b);
    cb(null, {
      name: profile.given_name + ' ' + profile.family_name,
      family_name: profile.family_name,
      given_name: profile.given_name,
      email: profile.email,
      email_verified: profile.email_verified,
      birthdate: profile.birthdate,
      gender: profile.gender,
      user_id: profile.sub
    });
  });
}
```

### Authorization header

Since netID requires _Basic Authentication_ for authentication, but custom social connections submit the credentials via post body per default, we need to create a custom header for the Authorization and add it to the configuration.

The hash is created by base64-encoding the `clientID` and `clientSecret` concatenated with a `:`. So the pseudo code to generate this would be:

`base64encode(clientId + ":" + clientSecret)`

An [online base64 encoding tool](https://www.base64encode.org/) can also be used to construct this value.

The full header is then constructed as per the [standard authorization header format](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization), setting the type to `Bearer`:

```
{
  "Authorization": "Basic <your base64-encoded token string>"
}
```

You can try out the connection by pressing the **Try Connection** button and, upon success, get a screen like this:

![Testing out the custom social connection](https://images.ctfassets.net/23aumh6u8s0i/2al4mPP0I9ZPMCwdJfSXRP/a82ea4c443fb069b2c4abe18aa57e3b4/netid_config-02)

Under the **Applications** tab, make sure that your client/application is enabled for this custom social connection.

Finally, adjust the **Universal Login Page** configuration and add a few lines of custom CSS to make the netID button appear with the respective logo and coloring. To do this, navigate to the [**Universal Login Page > Login Page** configuration](https://manage.auth0.com/#/login_page) and enable the **Customize Login Page** checkbox. Adjust the source code of the login page replacing the `theme` section in the JSON object with the following lines:

```js
theme: {
  logo:            config.icon,
  primaryColor:    colors.primary ? colors.primary : 'green',
  authButtons: {
    "netID": {
      displayName: "netID",
      primaryColor: "#74b82b",
      foregroundColor: "#fff",
      icon: "https://raw.githubusercontent.com/auth0-blog/auth0-netid-sample/master/img/favicon_trans.png"
    }
  }
},
```

Before:

![The code for the custom login page, before the change is made](https://images.ctfassets.net/23aumh6u8s0i/4fAXiCwgsRc8AdCzv5zd8u/5da7ab28832578872f1002b2877df832/netid_login-page-before)

After:

![The code for the custom login page, after the change is made](https://images.ctfassets.net/23aumh6u8s0i/4uEXHaZk1nO2mQUJ70TytY/6f0baed1947dbb2f54d3df46fdad68d3/netid_login-page-after)

## The Authentication Flow

### Screencast

For more context, you can view the following screencast of the authentication flow to get a better idea of how the integration with netID works:

<iframe width="560" height="315" src="https://www.youtube.com/embed/kY5Wu9FNQ8Y" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

### Authentication

When pressing the login button within the client application, Auth0 provides a login/signup widget with options to login/signup via username and password or via social logins, such as netID.

![Auth0 login screen with netID as a custom social connection](https://images.ctfassets.net/23aumh6u8s0i/69Cyef57ukleYtPp26FrjK/1281c86c93ee9548640695c354c5a037/netid_auth-01)

When choosing netID (we're assuming the end user already has an account at netID), the user will be asked to log in at netID, providing an email address.

> Note: if your client is running in sandboxed mode, as described here, it will only function with the whitelisted email addresses

![The netID login screen](https://images.ctfassets.net/23aumh6u8s0i/7bIMhHWXIhALpVi6cmO5Gl/4340eab10878885b503439f1c11efa37/netid_auth-02)

They will also need to provide their password:

![The netID password entry screen](https://images.ctfassets.net/23aumh6u8s0i/6jS5kZLe5rByfns4J11Ua2/f3f46538668e11338ce89e64792524be/netid_auth-03)

Upon successful login, they will be asked to give consent to netID to grant Auth0 access to their personal information:

![The netID personal information consent screen](https://images.ctfassets.net/23aumh6u8s0i/6qpyibpxShK5AYj03M9p6W/5dbdb7de076d3e8c35e37756dfc9dd60/netid_auth-04)

Furthermore, the demo client asks for consent to access the Auth0 tenant:

![The Auth0 consent screen](https://images.ctfassets.net/23aumh6u8s0i/48oJiahShr5bVO2fTNZ093/1694a5b2c38d2813393be6158efcda25/netid_auth-05)

After consent is given, the browser redirects to the application, having received an ID token and information about the user:

![Logged into a demo app using netID](https://images.ctfassets.net/23aumh6u8s0i/7k0wipMlKPaMB8wXYaZn36/be3ae0e27ac33ad6b9a4993d4ee24a71/netid_auth-06)

## Client App Creation in Auth0

In our example, we chose a **Single Page Application (SPA)** based on **Angular** delivered from a Node.js web server. You can choose any other technology stack as well though. In our case, the client application is created and configured as follows in the Auth0 backend:

1. Create the application by going to the **Applications** section in the dashboard and click the **+ Create Application** button.
   ![Creating a new Auth0 application](https://images.ctfassets.net/23aumh6u8s0i/1axrPu0RywAPmw2XW1zvEn/cee0b91b909cb19d95e62c9f97e8af65/netid_applications-create)
2. Next, give the application any name you like and choose **Single Page Web Application** as the type.
   ![Choosing an Auth0 application type](https://images.ctfassets.net/23aumh6u8s0i/i4uUaBNPyAx2QMlQ8TNhy/b611109b1917096e704310d3a0f4fd2a/netid_app-quickstart-01)
3. Next, choose **Angular** as the technology.
   ![Choosing a technology type](https://images.ctfassets.net/23aumh6u8s0i/1aeo8vqDfCu4JXWYN4q5DL/0a5705bc7ea5c5a772b874b46775af16/netid_app-quickstart-02)
4. Afterwards, you're given the choice to either integrate Auth0 into an existing app, or download a complete sample. Choose the latter and download the ZIP file.
   ![Angular quickstart page](https://images.ctfassets.net/23aumh6u8s0i/4kWcfmuXfKbJNiolIwRlf8/6faae6c438a390dc2fd5c6424ac709d7/netid_app-quickstart-03)
5. Download and unzip the file anywhere on your computer. Then, enter a local terminal window and switch to the folder where you extracted the project into.

To build and run the project, enter:

`npm install`

followed by

`npm start`

This should spin up a local Node.js web server, making the application available at [`http://localhost:3000`](http://localhost:3000).

Returning to the Auth0 dashboard, click the **Settings** tab of the app.

In the application settings:

- set **Application Type** to "Single Page Application".
- set **Allowed Callback URLs** to `http://localhost:3000/callback`
- set **Allowed Logout URLs** to `http://localhost:3000`

![Configuring the Auth0 application](https://images.ctfassets.net/23aumh6u8s0i/6WcPdXxzG1gT067PmKFR6p/f463cd808e252fd69991c5a1a353abe7/netid_auth0-app-settings)

As for the connections, click the **Connections** tab at the top of this page to enable any (other) connections that you want enabled besides **netID**. Note that custom social connections don't show on this screen, they are configured and within the **Custom Social Connections** extension itself. In our example, we chose to also offer authentication via **Username-Password-Authentication**, **facebook** and **google-oauth2**, besides **netID**, thus the respective switches are enabled.

![Configuring app connections](https://images.ctfassets.net/23aumh6u8s0i/3G3jKZ5VPR0n51YZjjQtGo/2e51513ac148e30f1b6e26f4aad9786c/netid_auth0-app-connections)

In the end, the application is listed in the **Applications** overview:

![The Auth0 application registered in the dashboard](https://images.ctfassets.net/23aumh6u8s0i/6J44Uf75tIp0ZE5UQdLUnZ/03232fb39dfeaf774eee2ca9cb59c711/netid_auth-07)

Once a user has gone through the process of logging into their app using Auth0 and netID, the user information can be inspected within the Auth0 dashboard by expanding the **Users & Roles** menu item on the left, and then choosing **Users**:

![The users that have registered with the sample app](https://images.ctfassets.net/23aumh6u8s0i/6GrJ1shfzzbpKC0W08NrWn/0740be76057ce5f10f68b2397fffa321/netid_users-01)

The user's primary identity provider is shown as `oauth2`:

![Viewing detailed information about the registered user](https://images.ctfassets.net/23aumh6u8s0i/4zCj9DeRH9QOM5fjKyg2hQ/b6f66034b30ae57d7ba7a6f2326dafb8/netid_users-02)

and the raw JSON of this user contains the netID identity of the user:

![Viewing raw JSON information about the registered user](https://images.ctfassets.net/23aumh6u8s0i/1LGS9ZCwgbvyIynjppoEun/652a08cfe203d9c80791aba0e459f495/netid_users-03)

### netID backend

The **Meine Daten** (My Data) section for the user within the netID backend:

![The netID "My Data" page](https://images.ctfassets.net/23aumh6u8s0i/4hDziEEJ8yVEk4ZmVfeqlV/5c5b2a949b0d99be1eab946efad11708/netid_my-data)

The user can see an overview of the approved applications/services under **Meine Dienste** (My Services):

![The netID "My Services" page](https://images.ctfassets.net/23aumh6u8s0i/7Ltkxj0vykjZ8PSxvSLVdV/6ecf9bba29b7a901611bb643f836b935/netid_my-services)

The user can always review and revoke their consent that grants the service access to their personal information:

![Revoking consent for the service to access personal information](https://images.ctfassets.net/23aumh6u8s0i/1PJXEAhS2ZOiIKvLOX3L2k/1a4c0e65c7adba9859df446496bd55ea/netid_revoke-service)

## Recap

In this post, you learned how Auth0 can help you add the German identity provider netID as an option for your end users to sign up and login to your web application. You saw how to configure netID as an Auth0 Custom Social Connection and supply all the necessary details to integrate with a netID application. Finally, we showed you a sample login process, and how user data can be inspected both on the Auth0 side, and within the netID portal.


netID Integration Using Custom Connections

956290?s=200

R&D Content Engineer

Luke Oliff

Hackference is a three-day conference and hackathon for attendees to learn something new. Auth0 sponsored this year, with Jeremy Meiss giving a compelling talk on using Identity Management providers instead of building your own, on Friday



This year, Auth0 attended [Hackference](https://2018.hackference.co.uk) as a sponsor. Besides [Jeremy Meiss](https://twitter.com/iamjerdog) giving a great talk on [power and value of identity providers](https://auth0.com/blog/5-reasons-your-company-needs-identity-and-access-management/) at Friday's conference, we remained on hand for the rest of the weekend to support the Hackathon.

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">Interesting stuff from <a href="https://twitter.com/IAmJerdog?ref_src=twsrc%5Etfw">@IAmJerdog</a> on Modern Identity and security best-practises <a href="https://twitter.com/auth0?ref_src=twsrc%5Etfw">@auth0</a> <a href="https://twitter.com/hashtag/hackference?src=hash&amp;ref_src=twsrc%5Etfw">#hackference</a> <a href="https://t.co/ItwKmwMAcn">pic.twitter.com/ItwKmwMAcn</a></p>&mdash; Nimvelo (@Nimvelo) <a href="https://twitter.com/Nimvelo/status/1050750593214636033?ref_src=twsrc%5Etfw">October 12, 2018</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

Hackference returns for its 6th year, ran and founded by the amazing [Mike Elsmore](https://twitter.com/ukmadlz). Its purpose is to provide a unique and hands-on learning environment free of any negative influences.

## What You Missed at the Conference

This year, the conference included two tracks: Innovate and Develop. Across these two tracks, speakers included [Doug Sillars](https://twitter.com/dougsillars) on modern image delivery techniques, [Karina Popova](https://twitter.com/kary_key) on geospatial analysis of Twitter content, [Alex Lakatos](https://twitter.com/lakatos88) on natural conversation pieces with bots, and [Jessica Rose](https://twitter.com/jesslynnrose) on a common issue in tech, Burnout. These are to name but a few. [Check out the schedule to see what you missed](https://2018.hackference.co.uk/#schedule).

## Hackathon Winners (of Auth0's prize)

Anna, Carol and Jamie of team "Who Dis?" built an advanced identity service designed to be self-hosted. Based on the IndieAuth login system, their app was created as a custom Auth0 identity provider. When accessing the app, authentication is requested via Auth0's centralised login page where you could select their custom identity provider which could then verify identity.

![Anna, Carol and Jamie of team "Who Dis?"](https://images.ctfassets.net/23aumh6u8s0i/10bWa7pxjl7Kc1xg7VG2d6/4c1ff2871859aaede3f9d42e267cfeb4/hackference-auth0-winners-who-dis)

## Hackathons

Hackathons are an important part of the development world! True innovation and creativity can be expressed in a supportive and collaborative environment, often with the added incentive of some amazing prizes.

Some famous features and products have been born from hackathons. Most notably, the [Facebook “Like” button and Facebook Chat](http://uk.businessinsider.com/facebook-hackathons-2017-6) were both born at company internal hackathons.

In an environment where innovation and creativity are nurtured, amazing things can happen.

These sites will help you find hackathons near you.

-  [Major League Hacking](http://www.mlh.io/)
-  [Hackalist](http://www.hackalist.org)
-  [Hack Club](https://hackathons.hackclub.com/)
-  [Devpost](http://www.devpost.com)
-  [Hackathon IO](http://www.hackathon.io)
-  [HackEvents](http://www.hackevents.co)
-  [HackathonsNear.Me](http://www.hackathonsnear.me)

<include src="asides/AboutAuth0" />


"identity provider"