Jose-Romaniello

Head of Engineering

Jose Romaniello

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Break down the differences and relationships between JOSE, JWT, JWS, JWE, JWA, and JWK with clear explanations and examples.

If you've worked with modern authentication or secure data exchange, you've undoubtedly encountered JSON Web Tokens, or JWTs. However, if you dig deeper, you may encounter a series of confusing acronyms: JWS, JWE, JWK, JWA, and the umbrella term, JOSE. What do they all mean? How do they relate to each other?

It's easy to get lost, but these concepts are actually designed to work together in a logical system. Think of it like **a secure shipping company**. You have the package, the tamper-proof seal, the locked box, the keys, and the set of rules for how to handle everything. This article will unpack each of these components, trying to clarify their roles and how they come together to create the secure tokens we rely on.

## What Is JOSE (JSON Object Signing and Encryption)?

Let's start with the big picture: **JOSE**.

JOSE isn't a single technology you can install or a specific format. Instead, it's a **framework** or [a collection of IETF (Internet Engineering Task Force) standards](https://datatracker.ietf.org/wg/jose/documents/). Its purpose is to provide a standardized way to securely transfer [claims](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-claims) between parties.

Think of **JOSE as the entire shipping and logistics company**. It doesn't represent a single box or key, but rather the complete set of rules, tools, and specifications for shipping things securely. It defines how to create signed messages (JWS), encrypted messages (JWE), the keys to use (JWK), and the algorithms allowed (JWA).

The JOSE framework is composed of several key specifications, which we will explore next.

## JWS (JSON Web Signature)

[JWS](https://datatracker.ietf.org/doc/html/rfc7515) is a standard for signing data. Its primary goals are to ensure **integrity** and **authenticity**:

* **Integrity:** Guarantees that the data has not been tampered with in transit.  
* **Authenticity:** Verifies that the sender is who they claim to be.

A JWS object doesn't hide the data; it just adds a signature that the recipient can verify. It's like putting a letter in a clear envelope and sealing it with a unique, tamper-proof wax seal. Anyone can read the letter, but the seal proves it came from the right person and hasn't been opened.

A JWS object, or more simply a JWS, can be represented in a compact, URL-safe string composed of three parts, separated by dots (`.`):

![Diagram showing the three-part structure of a JWS (JSON Web Signature): a Base64Url encoded Header, Payload, and Signature, each separated by a dot.](https://images.ctfassets.net/23aumh6u8s0i/4mDvsqLEA5NtlrbD6hVap5/c6b0a8f7d4eb8ecd53188f9fa0969adb/jws-parts.png)  This representation is called [JWS Compact Serialization](https://datatracker.ietf.org/doc/html/rfc7515#section-7.1).

> A JWS can also be represented as a JSON object in two different flavors:  [General JWS JSON Serialization](https://datatracker.ietf.org/doc/html/rfc7515#section-7.2.1) and [Flattened JWS JSON Serialization](https://datatracker.ietf.org/doc/html/rfc7515#section-7.2.2). 

Here is an example of a JWS object represented through JWS Compact Serialization:

```shell
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```

Decoding each of these parts, you’ll get the following:

* **Header:** Metadata about the signature, such as the signing algorithm used:

```json
{
  "alg": "HS256",
  "typ": "JWT"
}
```

* **Payload:** The actual data being secured (the claims):

```json
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}
```

* **Signature:** Created by signing the encoded header and payload with a secret key.

## JWE (JSON Web Encryption)

[JWE](https://datatracker.ietf.org/doc/html/rfc7516) is a standard for encrypting data. Its primary goal is **confidentiality**.

Unlike JWS, which leaves the data readable, JWE makes it unreadable to anyone without the correct keys. This is like putting your letter inside a locked metal box before shipping it. Only the person with the key can open it and see the contents.

A JWE object, or more simply a JWE, can also be represented in a compact string, but it has five parts separated by dots (`.`):

![Diagram illustrating the five-part structure of a JWE (JSON Web Encryption): JOSE Header, Encrypted Key, Initialization Vector, Ciphertext, and Authentication Tag.](https://images.ctfassets.net/23aumh6u8s0i/5iLpAkZozPYVkbQkxYFPfD/1e839dd26ce2637c2e52c9657b88efd5/jwe-parts.png)  This is the [JWE Compact Serialization](https://datatracker.ietf.org/doc/html/rfc7516#section-3.1) representation. 

> As for a JWS, a JWE can also be represented as a JSON object in two different flavors:  [General JWE JSON Serialization](https://datatracker.ietf.org/doc/html/rfc7516#section-7.2.1) and [Flattened JWE JSON Serialization](https://datatracker.ietf.org/doc/html/rfc7516#section-7.2.2). 

Here is an example of the JWE Compact Serialization representation:

```shell
eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ.OKOawDo13gRp2v6GZfDqztYe70eG6o0f6ZlH5_yl1TjSGhbyT2KVdD2iM0ik2aO_hJAFy8uMwk2nN25OJaSqa1L58U9b2JTJmYnE9LzE6W1-nZz1tQ1tY4C8z4p2v6G.AxY8DCtDaGlsbGljb3RoZQ.KDlT9LgK3-tV3hVucpYh_g.GawgguFyGrWKav7AX4VKUg
```

Breaking it down, you will find the following parts:

* **JOSE Header:** Contains metadata about the encryption algorithms.  
* **JWE Encrypted Key:** The key used to encrypt the content, which itself is encrypted with the recipient's public key.  
* **JWE Initialization Vector:** A random value to ensure the encryption is unique. If an algorithm does not utilize an Initialization Vector, this value will be an empty octet sequence..  
* **JWE Ciphertext:** The encrypted payload.  
* **JWE Authentication Tag:** A value used to verify the integrity of the encrypted data. In case an algorithm does not use an Authentication Tag, this value will be an empty octet sequence.

## JWA and JWK

Now, both JWS and JWE use algorithms and keys to sign and encrypt data. How do they know *which* algorithms and *which* keys to use? That's where JWA and JWK come in. They represent the tools for sealing, locking, and unlocking in our metaphorical shipping company.

### JWA (JSON Web Algorithms)

[JWA](https://datatracker.ietf.org/doc/html/rfc7518) is simply a specification that defines the cryptographic algorithms that can be used for signing and encryption within the JOSE framework. It doesn't contain any code; it's a registry of identifiers.

For example, when the JWS header contains `"alg": "HS256"`, it's referring to the [HMAC](https://en.wikipedia.org/wiki/HMAC) algorithm using SHA-256 algorithm. Other examples include `"RS256"` for RSA signatures or `"A256GCM"` for [AES-GCM](https://en.wikipedia.org/wiki/Galois/Counter_Mode) encryption.

### JWK (JSON Web Key)

[JWK](https://datatracker.ietf.org/doc/html/rfc7517) is a standard for representing cryptographic keys in a JSON format. Instead of passing around key files in different formats (like [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) or [DER](https://en.wikipedia.org/wiki/X.690#DER_encoding)), you can represent them as a JSON object. This is especially useful for web-based applications where JSON is the native language.

A JWK contains metadata about the key, such as its type, usage (signing or encryption), and the key values themselves.

Here is an example of an RSA Public JWK:

```json
{
  "kty": "RSA",
  "use": "sig",
  "kid": "my-rsa-key-1",
  "n": "u4V_...",
  "e": "AQAB"
}
```

*   
  `kty` (Key Type): Identifies the crypto family (e.g., "RSA", "EC").  
* `use` (Public Key Use): Defines the intended use (e.g., "sig" for signature, "enc" for encryption).  
* `kid` (Key ID): A unique identifier for the key, useful when an application has multiple keys.  
* `n` and `e`: The modulus and exponent values for the RSA public key.

### JWKS (JWK SET)

You may have heard about [JWKS](https://datatracker.ietf.org/doc/html/rfc7517#section-5). This is a standard specification to represent a set of JWK objects. The following is an example of JWKS object containing two JWK objects:

```json
{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "n": "sySYvu...",
      "e": "AQAB",
      "kid": "MDc...",
    },
    {
      "kty": "RSA",
      "use": "sig",
      "n": "rxFxz...",
      "e": "AQAB",
      "kid": "_dqx...",
      "x5t": "IwL...",
      "x5c": [
        "MIIDAz..."
      ],
      "alg": "RS256"
    }
  ]
}
```

The JWKS object must have a `keys` member, which is an array of JWKs.

> Auth0 provides a JWKS endpoint for each tenant at `https://<YOUR-DOMAIN>/.well-known/jwks.json`. This endpoint returns the JWK objects associated with that specific tenant. Applications use this endpoint to dynamically fetch the public keys needed to verify JWTs issued by your Auth0 tenant.

## What About JWT?

Finally, we arrive at the most well-known acronym: [JWT (JSON Web Token)](https://datatracker.ietf.org/doc/html/rfc7519).

A JWT is **not** a new technology separate from the others. A JWT is a specific **type of payload** or a set of claims that is transported *using* JWS or JWE. It's the "what" that goes inside the secure container.

Referring once again to the metaphor of the shipping company, if JWS is the sealed envelope, the **JWT is the letter inside it**. The JWT standard defines a compact, self-contained way for representing information between two parties. It specifies a set of standard claim names like `iss` (issuer), `exp` (expiration time), `sub` (subject), and `aud` (audience).

Here is an example of a JWT Payload (Claims Set):

```json
{
  "iss": "https://my-auth-server.com",
  "sub": "user-123",
  "aud": "my-api",
  "exp": 1664532000,
  "name": "Jane Doe",
  "isAdmin": true
}
```

## Why Is a JWT Often Called a JWS or JWE?

This is the most common point of confusion. People often use "JWT" and "JWS" interchangeably. Is that correct?

Mostly, yes. A JWT is just the set of claims. To be useful, it must be securely transmitted. The way you make it secure is by signing it (creating a JWS) or encrypting it (creating a JWE).

* When you **sign** a JWT payload, the resulting token is technically a **JWS**. This is the most common form of JWT.  
* When you **encrypt** a JWT payload, the resulting token is technically a **JWE**.  
* It's also possible to have a **nested JWT**, where a JWT payload is signed (JWS) and then the entire JWS is encrypted (JWE).

So, when someone says "here is my JWT," they are almost always handing you a **JWS whose payload is a set of JWT claims**. The term "JWT" has become a colloquial shortcut for "a JWS containing JWT claims."

> You learned earlier that JWS and JWE objects can be represented as JSON objects. However, these representations can’t be used for JWTs. As [the specifications say](https://datatracker.ietf.org/doc/html/rfc7519#section-1), a JWT is always represented through JWS or JWE Compact Serialization.

## Recap

Although the JOSE acronyms may seem intimidating, the underlying concepts are actually distinct and logical once understood correctly. So, to summarize:

* **JOSE** is the overarching framework.  
* **JWS** and **JWE** are the secure containers—one is signed, the other is encrypted.  
* **JWA** and **JWK** are the tools—the algorithms and keys used to secure the containers.  
* **JWT** is the content—the standardized set of claims you put inside the container.

For your convenience, here is a summary table that recaps the differences between the items of the JOSE framework, including the references to the secure shipping company’s metaphor:

![A comparison table summarizing the JOSE framework. It defines JWT, JWS, JWE, JWK, and JWA, explaining the purpose and analogy for each specification.](https://images.ctfassets.net/23aumh6u8s0i/1a5zCuR79251Uk5c4JkTIa/98ab9ad626ded2850e3c5b0bed646746/jose-acronyms-table.png)

Demystifying JOSE, the JWT Family: JWS, JWE, JWA, and JWK Explained

I started working at Auth0 before the first line of code for our authentication platform existed. I’ve been able to go through the journey of seeing our ideas go from prototype to living production code that impacts millions of people. It’s satisfying to know that my actions here are having a positive impact in solving problems for developers like me.

Learn how to apply the Scout code to software development to get code to a better state continuously.



When I was a kid, I practiced [_Scouting_](https://en.wikipedia.org/wiki/Scouting) for eight years I picked up a lot of excellent values and my scouting experiences helped to shape my character and make me a better programmer. Let me show you why.

As a Scout, you get to experience nature by camping outdoors which teaches you one of the core values — **respect life**. Scout rules help support core Scout values. One of the first rules I learned was:

> Always leave the campground cleaner than you found it.

This rule comes from a quote by [_Robert Baden-Powell_](https://en.wikipedia.org/wiki/Robert_Baden-Powell,_1st_Baron_Baden-Powell), founder and first [_Chief Scout_](<https://en.wikipedia.org/wiki/Chief_Scout_(The_Scout_Association)>) of [_The Scouts Association_](https://en.wikipedia.org/wiki/The_Scout_Association), and founder of the [_Girl Guides_](https://en.wikipedia.org/wiki/Girlguiding):

> Leave this world a little better than you found it.

What this rule represents is that you should not only pick up your trash, clean the area where you started a wood fire and the soil where you built your tent, but also you need to take a look at the campsite and do something to leave it better than it was before.

It is an explicit instruction. It helps you accept the notion that something can always be better. There’s always room for improvement. You had the opportunity to enjoy the area and its resources but you also have the opportunity to pay back by leaving the area in better shape for others.

I believe that when kids are taught this kind of values through games, repetition, and rewards, it becomes a habit. This is nominally known as [_positive reinforcement_](https://en.wikipedia.org/wiki/Reinforcement#Positive_reinforcement). Positive reinforcement takes place when a reward is presented as the result of certain behavior and the behavior increases. This trait has been embedded in my mind so that I don’t need to apply it consciously. It has become a behavioral reflex that integrates naturally in my day-to-day activities.

## The Codebase Is the Developer's Campsite

Even if I don't go camping often nowadays, I follow this rule in a lot of different situations in my life. One of them is in my daily work — programming!

Working on a new feature or a bug feels excellent. Working on a codebase change feels like camping as a Scout. It is an opportunity to:

- Experience the environment.
- Understand the problem.
- Put what I know in practice.
- Use my skills to create solutions.

The codebase will host me for hours or days. Even if I don't enjoy the codebase too much, I still have to respect it because other people have worked hard on it. It gives me an opportunity to learn new things and to possibly use tools I have never been exposed to before.

<include src="TweetQuote" quoteText="Even if we don't enjoy a codebase too much, we still have to respect it because other people have worked hard on it. We can work on taking little steps to improve it."/>

Once again, I have to assume that other people will get to "camp" in the project after me. People I haven't met yet and probably will never meet. They may be developers, project managers, even end-users. As thought leader and software craftsman [_Uncle Bob Martin_](https://twitter.com/unclebobmartin) says in his [_Scout Rule_](https://www.amazon.com/Things-Every-Programmer-Should-Know/dp/0596809484):

> “Indeed, the act of leaving a mess in the code should be as socially unacceptable as littering. It should be something that just isn't done.”

Therefore, not only my work in the codebase needs to be clean, but it should leave the code at least a little better than I found it.

These are some examples in which I have applied this improvement of the status quo within a project:

- It took me 30 minutes to understand what this function does. Can I rename it to something more declarative or expressive so that others can understand it quicker than I did?
- I wasn't able to run this project with the provided instructions. Can I write the instructions that I followed but are not documented in a README file?
- This code is more convoluted than it should be. Can I make it easier and clearer?
- This function doesn’t have enough tests. Can I add some tests?

These small improvements will help my teammates and myself later. The code is not going to end up perfect, but it will be better than it was before. By following this practice, the code grows in a better direction with every action that you take on it.

<include src="TweetQuote" quoteText="Small but powerful actions for teams that improve a codebase gradually: Vague naming? Make it explicit. Confusing code? Make it clearer. No documentation? Add steps to the README. Missing tests? Write one."/>

I have been doing software development for years and being a Scout had already prepared me to transfer the mindset and values exposed by Uncle Bob from the campsite to the codebase. But this approach is not an excuse for not allocating exclusive time and developers to fix issues in a codebase; it is just one way to continuously get things to a better state.

![Binary tree - example of clean code growing organically and gradually following the Scout development approach.](https://images.ctfassets.net/23aumh6u8s0i/5KLuJlW0dEoHg3Wf03i7t9/a11e8be6f2480802675a8d4daaf6c3c2/Binary-Tree)

<include src="asides/AboutAuth0" />


A Scout Approach to Software Development

The Auth0 Australia Region joins the US and EU regions, extending our ability to offer the lowest login latency and allow subscribers to meet any applicable compliance requirements.



---

**TL;DR**: The Auth0 Australia Region launches to join the US and EU regions in helping subscribers lower login latency and meet compliance regulations for data residence.

---

We’re happy to announce that the Auth0 Australia Region has launched! Auth0 is on a mission to make identity simple for developers and IT professionals everywhere - something we’re already doing for more than 30,000 subscribers across more than 150 countries worldwide. Now those in and closest to Australia will enjoy even lower latency logins.

![auth0 australia](https://images.ctfassets.net/23aumh6u8s0i/70hRYE1NWs2kEwEYHNy1H2/45e813ff330cf6e85d8db38d985ad9cc/australia-map)

## One Auth0, three continents

The Auth0 Australia Region joins the [US and EU regions](https://auth0.com/blog/2015/04/27/auth0-europe-launches/) previously available, extending our ability to offer the lowest login latency and allow subscribers to meet and exceed any applicable compliance requirements. Respective to all of the regions in which we operate, Auth0 is committed to following all legislation governing data regulation, privacy and consumer law.

Auth0 subscribers can specify their preferred location by simply choosing from a dropdown when they create a free developer account. Existing subscribers who are running from the US or EU regions and want to switch should just [let us know](https://support.auth0.com) and we’ll help with the migration. Several Auth0 subscribers have already made a quick and successful transition.

![auth0 australia](https://images.ctfassets.net/23aumh6u8s0i/1TD9R5r9f1Xs3jm0HD4jfY/4efd61311d5e176452cda6ffa79a90ca/australia-region)

## Even faster

When you choose a service region closer to where your customers operate, you can experience some great login latency improvements. Subscribers who migrated from the US to the EU Region saw [latency improvements of nearly 2x](https://auth0.com/blog/2015/04/27/auth0-europe-launches/); the same is true for those now migrating to Auth0 Australia.

<include src="TweetQuote" quoteText="Choosing a service region closer to where your customers operate can improve login latency."/>

## We’re here to help

As always, we’d be happy to answer any questions or provide any assistance related to the new Australia region, or anything else. [Open a support ticket](https://support.auth0.com), chat with us at [https://chat.auth0.com](https://chat.auth0.com) or ask anything at ask.auth0.com.

We look forward to hearing from you!


G’day, Mate! Auth0 Australia Launches

Amazon introduced today a new feature called AWS Directory Service. In a nutshell, it allows:  Connect existing Active Directory to the cloud or to create

Amazon introduced today a new feature called [AWS Directory Service](http://aws.amazon.com/es/directoryservice/). In a nutshell, it allows:

- Connect existing Active Directory to the cloud or to create complete new Directories from scratch.
- Seamless administration of AWS Resources.
- Seamless access to AWS applications for end-users.
- Simplify Deployment of Windows Workloads on AWS.
- Pay as you go (0.05 $/hr for small installations and $0.15 for large)



More information at <http://aws.amazon.com/es/directoryservice/>

In this short tutorial we will deploy a new **AWS Simple AD**, connect it to an Active Directory MMC and configure it to work with Auth0.


### Configuring the Simple AD

Open up the [Directory Service console](https://console.aws.amazon.com/directoryservice/home) and create a new Simple AD:

![ss-2014-10-22T13-38-02.png](https://images.ctfassets.net/23aumh6u8s0i/4hdt63yIvImwL4v5WBcsgz/e251033c22462efb33fa807fa0616884/ss-2014-10-22T13-38-02)

This operation can take a while to complete.

> Notice that Simple AD doesn't have a way to manage its user and roles, so the next thing we are going to do is to deploy a Windows EC2 instance on the same VPC.


### Deploy Management Interface

In this step we will deploy a new Windows 2012 VM instance and join it to the windows domain.

-  Launch a new Windows 2012 on EC2.
-  Connect via Remote Desktop
-  Open **Network Connections** or run `%SystemRoot%\system32\control.exe ncpa.cpl`.
-  Right-click any enabled network connection and select **Properties**.
-  In the connection properties dialog box, double-click **Internet Protocol Version 4**.
-  Select **Use the following DNS server addresses**, change the **Preferred DNS server** and **Alternate DNS server** addresses to the IP addresses of the **Simple AD** and click **OK**:

![ss-2014-10-22T13-44-18.png](https://images.ctfassets.net/23aumh6u8s0i/6aqa4UUFNyEMgBbxfp7mQ2/e27e77ddcf86f8a9ac4b1981a5e39258/ss-2014-10-22T13-44-18)

-  Open **System Properties** or run `%SystemRoot%\system32\control.exe sysdm.cpl`, select the **Computer Name** tab, and click **Change**:

![ss-2014-10-22T13-51-24.png](https://images.ctfassets.net/23aumh6u8s0i/5CtCNLhQtKsbLh5X5Ukv34/bf75d2599483d284fff63bfd87baf144/ss-2014-10-22T13-51-24)

-  You will have to enter a username and password, use **Administrator** and the password you selected when creating the **Simple AD**.
-  You will need to restart the machine.
-  Connect again via **Remote Desktop** but this time use a domain account with the qualifier, for our example `corp.contoso.com\Administrator`.
-  Open **Program and features** or run `%SystemRoot%\system32\control.exe appwiz.cpl`
-  Click on **Turn Windows features on or off**
-  Go to the **Features** step , expand **Remote Administration Tools**, then **Role Administration Tools** and then select **AD DS and AD LDS Tools**:

![ss-2014-10-22T14-00-26.png](https://images.ctfassets.net/23aumh6u8s0i/6c6s8c9KMAkJ6bWeb1YavG/5239719de23f4ab766b71ec990c064e3/ss-2014-10-22T14-00-26)

Now you will be able to create Users and Groups on your __AWS Simple AD__ using the **Active Directory Users and Groups**:

![ss-2014-10-22T14-04-06.png](https://images.ctfassets.net/23aumh6u8s0i/2787df6OIkmYNb2DdRpkwY/d97054141e5609e1b3c1289cb59e55da/ss-2014-10-22T14-04-06)


### Connect your new directory to Auth0

####1. Create a new **AD LDAP** Enterprise connection in Auth0

![ss-2014-10-22T14-33-10.png](https://images.ctfassets.net/23aumh6u8s0i/bvjWrmle4x5cGlGlaRNpk/c445b6bb43f21f9c124d235ede770046/ss-2014-10-22T14-33-10)


Optionally, you can enable __Kerberos__ to use __Windows Integrated Authentication__ on machines joined to the same domain.

Copy the _TICKET URL_ provided by auth0 and paste in a browser inside the Windows Machine provisioned in the previous step.

####2. Download and install the agent:

![ss-2014-10-22T11-49-40.png](https://images.ctfassets.net/23aumh6u8s0i/4GajblgEWfrRSD0x2ieyUk/7febdcd80d851881c42a5c573bfb4160/ss-2014-10-22T11-49-40)

After the installation a new page in the browser will came up, paste your TICKET URL:

![ss-2014-10-22T14-34-15.png](https://images.ctfassets.net/23aumh6u8s0i/6MNTKPlvP70uqFV6hgecJ6/17c73ddb18db9cabdc9e026b7485af33/ss-2014-10-22T14-34-15)

Complete the LDAP config settings

![ss-2014-10-22T11-58-22.png](https://images.ctfassets.net/23aumh6u8s0i/31033mo44TcfUY2Wv2ssnQ/91ef566c8d1c60e8143d315d15221822/ss-2014-10-22T11-58-22)


### Testing your new connection

If you go back to your Auth0 Dashboard you should see now a green icon:

![ss-2014-10-22T13-14-43.png](https://images.ctfassets.net/23aumh6u8s0i/1x8bxMDIkK6gRCiOSHLa1l/2519f144a18418f067fda3536b6c5fef/ss-2014-10-22T13-14-43)

Click the __Try__ button and enter the user credentials:

![ss-2014-10-22T13-15-55.png](https://images.ctfassets.net/23aumh6u8s0i/bfh4uv8mSEEWxGxLyLK1Q/a1039ab856f3df677f0323b7ff8ee26f/ss-2014-10-22T13-15-55)

If you see this screen, then everything is working as expected:

![ss-2014-10-22T14-37-20.png](https://images.ctfassets.net/23aumh6u8s0i/5wAZM4G8c6As3m0vHvBGLK/a9056a9c7b03b1ef6a0eacb27fba8311/ss-2014-10-22T14-37-20)

## So, what can I do now with Auth0?

When you plug Auth0 to your Active Directory you can:

* Have your custom **web, single page apps and mobile apps** authenticate with the **AWS AD** in minutes
* Connect the **AWS AD** with **Salesforce**, **Zendesk**, **NewRelic** and other SAML-based application.
* Connect the **AWS AD** with Open Source platforms like **WordPress**, **Drupal** and **Discourse**
* Configure **Single Sign On** between all these applications
* Add **Multi-factor** authentication to these applications
* **Extend the user profile** with application-related metadata

![](https://images.ctfassets.net/23aumh6u8s0i/2PuR0YVJhXnup2gw1TD7xA/1ebcf42398155c2652d65e37666f9a93/pub_w_1219_h_558)

More information about Auth0: <https://auth0.com/how-it-works>

Simple Guide to Setup AWS  Directory Service

We are moving from the deprectad Google Apps Provisioning API to the new Google Apps Directory API. This will affect you only if you are using Google Apps

We are moving from the deprectad [Google Apps Provisioning API](https://developers.google.com/google-apps/provisioning/) to the new [Google Apps Directory API](https://developers.google.com/admin-sdk/directory/).

__This will affect you only if you are using Google Apps and the `/users` endpoints of Auth0.



Google Apps Provisioning API has been deprectated few months ago, on the other hand the new API has some advantages like providing a public link for the profile photo and having more granular scopes.

__Previously permisive scope:__

![Previously permisive scope](https://images.ctfassets.net/23aumh6u8s0i/3wuKxrpfLUFTc3LD0aQkIF/3d525ed21b52a54e3a13952b26e3d024/ss-2013-09-27T15-17-16_safe_save_152024)

__New granular scope:__

![New granular scope](https://images.ctfassets.net/23aumh6u8s0i/7z5aAUF5nxsGvc5nj89Jfk/0574a0241ddeb95497c0da8907e9e5d4/ss-2013-09-27T15-25-52_safe_save_152637)

In order to have access to this API enable the "Admin SDK" service in the [Google API Console](https://code.google.com/apis/console) as follows:

![ss-2013-09-27T15-33-02.png](https://images.ctfassets.net/23aumh6u8s0i/7LlyKqhK8xS3sQ52fGWrEt/e4bcb84972a7c064dd18ea2f40ed4465/ss-2013-09-27T15-33-02)

New __Google Apps Connections__ will automatically use this new API and pre-existing connections will need to be re-provisioned by following the provisioning link. If you are the domain administrator follow this link, if not copy and send the link to the domain admin:

![](https://dl.dropbox.com/s/6hojv2cdhl1sw6i/ss-2013-09-27T15-28-44.png)

Until you have done this step, the `/users` endpoint will return only the users that have signed in to your app at least once.

Moving to Google Apps Directory API

Auth0 is now available on Heroku as an add-on (private beta for now), making it incredibly easy to add Enterprise SSO, Consumer Logins, Directories queries

Auth0 is now available on [Heroku as an add-on](https://addons.heroku.com/auth0) (private beta for now), making it __incredibly easy__ to add Enterprise SSO, Consumer Logins, Directories queries, user access audit and many advanced identity management to any app hosted there. [See here for a complete list of supported identity providers in Auth0](http://docs.auth0.com/identityproviders): Consumer and Enterprise.

A 3 min video is worth 1,000,000 words. Take a look:



<iframe width="710" height="533" src="//www.youtube.com/embed/Q0MVRgC-ptg?rel=0&vq=hd1080" frameborder="0" allowfullscreen></iframe>

[Try Auth0 yourself!](https://auth0.com)

Auth0 for Heroku hosted apps

Since we released the beta, one of the things our customers have been telling us, is they want us to support a "username/password" authentication.

Since we released the beta, one of the things our customers have been telling us, is they want us to support a "username/password" authentication. Auth0 is being used today by two different audiences:



-   **Cloud apps**: they want to have a single uniform authentication and login analytics, across all the options: social providers, enterprise providers (like Google Apps or Active Directory, SAML Providers) and now, username and password.

-   **Organizations**: our enterprise customers, typically have already a dozen (sometimes more) of "identity silos" created for different apps, at different times and they want to consolidate those databases.

### Enter Database Connections

Database Connections works exactly like "Custom Connections" but with some advantages:

-   you don't have to deploy another application
-   seamless widget integration
-   a whole set of templates for your needs
-   develop, try and debug in the cloud without needing to install any tool

### Example: ASP.NET Membership Provider

Suppose we have already started to build a product using the standard [ASP.NET Membership Provider](http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx). ASP.NET Membership autogenerates a set of tables and relationships in Sql Server as shown here:

![](https://images.ctfassets.net/23aumh6u8s0i/26Ne1r7Cu5BAvPccDJj1bk/b47446405fa3aaee31d4619795505498/A4N95VJO07-1200x1200)

We would start by creating a new Database Connection in Auth0. Then we can pick the ASP.NET Membership Provider from the list:

![](https://images.ctfassets.net/23aumh6u8s0i/2hm42zu7yMmexxcKGS8rZ/26347d0caae8aa0ad5fab65062be9f3c/Screen_20Shot_202013-06-03_20at_205)

We can tweak the script to fit our needs:

![](https://images.ctfassets.net/23aumh6u8s0i/5ibHFyRdxAUdaYwYf9xxAj/3d39d1282c5da51ce32103af09a305e3/Screen_20Shot_202013-06-03_20at_205)

Connection strings and passwords should be stored as configuration settings in the bottom pane:

![](https://images.ctfassets.net/23aumh6u8s0i/4cDApZFbPaVcXDVVhruc1A/14b50a7d00f80da3fad919ecd2477402/Screen_20Shot_202013-06-03_20at_205)

We can open at anytime the Try window to run our script:

![](https://images.ctfassets.net/23aumh6u8s0i/7uMWjjxRI0MUsmOaVw5nfr/272daf2d388ff2cf1abe3af577d22413/Screen_20Shot_202013-06-03_20at_205)

In order to debug the script you can take advantage of `console.log`:

![](https://images.ctfassets.net/23aumh6u8s0i/5hj6fNoGfTuznEe5OPUf0v/01301315d8ae03ffa27f12e145bd6a7a/Screen_20Shot_202013-06-03_20at_205)

When the login is succesful you will see a green border and the result profile:

![ss-2013-06-04T10-51-04.png](https://images.ctfassets.net/23aumh6u8s0i/1gvjlQeEqNcRCKajADfURH/d0a418c8357fda43283890bfb51c04b4/ss-2013-06-04T10-51-04)

After we have finished the script, the login widget in our site will look like this:

![](https://images.ctfassets.net/23aumh6u8s0i/10x5ujAdevu4VbUhhZLIbF/cf937dbcfad1721fc251fa517459ce83/Screen_20Shot_202013-06-03_20at_205)

### Get started today

Read the [tutorial](https://docs.auth0.com/mysql-connection-tutorial) in our documentation page to get started.

<em>This feature is available in both the enterprise appliance and cloud version. [Try Auth0 yourself!](https://auth0.com)</em>

"jose"