5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn what SAML is and how to set up a SAML identity provider

In this article, you'll learn what SAML is, how it works, and how you can configure a SAML identity provider using Auth0.

<AmpContent>
<amp-youtube
    data-videoid="eaIGGO_NQJA"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/eaIGGO_NQJA' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## What is SAML

Before jumping into the technical jargon, let's look at an example that demonstrates _what_ SAML is and _why_ it's beneficial.

You just started working at a new company, Wizova. They've given you a work email address and access to a dashboard. Once you sign in to this dashboard, you're presented with the icons of all of the external services the company uses: Salesforce, Expensify, Jira, AWS, and more.

You click on the Salesforce icon, some magic happens in the background, and before you know it, you're signed into Salesforce without ever entering any credentials.

As you might have guessed, the "magic" was actually SAML in action. So what's going on here?

SAML stands for Security Assertion Markup Language. It is an XML-based open-standard for transferring identity data between two parties: an identity provider (IdP) and a service provider (SP).

Identity Provider — Performs authentication and passes the user's identity and authorization level to the service provider.

Service Provider — Trusts the identity provider and authorizes the given user to access the requested resource.

In the scenario above, the identity provider would be the IdP that Wizova uses, Auth0. The service provider would be [Salesforce](https://www.salesforce.com/blog/sales-management-dashboards/). The Wizova employee signs into the Wizova dashboard with Auth0. They click on the Salesforce icon, and Salesforce recognizes that the user wants to log in via SAML. Salesforce sends the employee back to Auth0 with a SAML Request that asks Auth0 to authenticate the user. Since the employee has already authenticated with Auth0, Auth0 verifies the session and sends the user back to Salesforce with a SAML Response. Salesforce checks this response, and if it looks good, the employee is granted access.

## Benefits of SAML Authentication

- **Improved User Experience** — Users only need to sign in one time to access multiple service providers. This allows for a faster authentication process and less expectation of the user to remember multiple login credentials for every application. In the example above, that user could have clicked on any of the other icons in their dashboard and been promptly logged in without ever having to enter more credentials.

- **Increased Security** — SAML provides a single point of authentication, which happens at a secure identity provider. Then, SAML transfers the identity information to the service providers. This form of authentication ensures that credentials are only sent to the IdP directly.

- **Loose Coupling of Directories** — SAML doesn't require user information to be maintained and synchronized between directories.

- **Ability to Alter, Audit, or Revoke Access Centrally** — Because SAML doesn’t require synchronization between directories for each application, it isn’t necessary to notify each service provider to revoke or change access levels, meaning that access can be revoked quickly if necessary for a single service or across an enterprise. Similarly, auditing who has access to which services is easy with SAML because authentication logs are centralized.

- **Fewer Password Reset Requests** — Users only need to remember one set of credentials, so IT can focus on supporting your workforce without having to respond to numerous password reset requests.

- **Scalability** — Adding new users, applications, or services is straightforward, minimizing the overhead necessary for your organization to grow.

- **Reduced Costs for Service Providers** — With SAML, you don't have to maintain account information across multiple services. The identity provider bears this burden.

![how saml works separator 1](https://images.ctfassets.net/23aumh6u8s0i/21h3c71TFRMhR4nbU7AIkY/1c70c92d02ad10a334ab90144721d809/how-saml-works-1)

## How Does SAML Authentication Work?

Now that you've seen the high-level overview of how SAML authentication works, let's look at some of the technical details to see how everything is accomplished.

SAML single sign-on authentication typically involves a service provider and an identity provider. The process flow usually involves the _trust establishment_ and _authentication flow_ stages.

Consider this example:

- Our identity provider is **Auth0**
- Our service provider is a fictional service, **Zagadat**

> **Note**: The identity provider could be any identity management platform. 

Now, a user is trying to gain access to **Zagadat** using SAML authentication.

Let's break down how the different components of the diagram interact with each other to make authentication with SAML possible. The following diagram gives you a high-level overview of how SAML works:

![Process flow diagram](https://images.ctfassets.net/23aumh6u8s0i/3R8llxfSq6UuhWdagCaJjZ/1b2fd3d2e3645d35697b2016e25d3dd3/01_saml_flow.png)

Here is a description of each numbered step in the diagram:

1. The user tries to log in to Zagadat from a browser.
2. Zagadat responds by generating a SAML request. ![Typical SAML Authentication request](https://images.ctfassets.net/23aumh6u8s0i/2q3DgHFxiJCn8OB57rIaZ3/9b6da4bcbab9987d88dedc1bd42dbb8d/samlrequestzg)
3. The browser redirects the user to a [Single Sign-On (SSO) URL](https://auth0.com/docs/authenticate/single-sign-on), **Auth0**.
4. **Auth0** parses the SAML request and authenticates the user. This could be with username and password or even social login. If the user is already authenticated on Auth0, this step will be skipped. Once the user is authenticated, Auth0 generates a SAML response. ![Typical SAML Authentication response](https://images.ctfassets.net/23aumh6u8s0i/60UOe2pqoOcYFJqeGMzfA7/e0dd3cdd9a12b682fa648f27869b9588/SAMLResponse)
5. **Auth0** returns the encoded SAML response to the browser.
6. The browser sends the SAML response to **Zagadat** for verification.
7. If the verification is successful, the user will be logged in to **Zagadat** and granted access to the resources that they are authorized to view/modify.

Note the attributes that are highlighted in the SAML request and response. Here's a glossary of these parameters:

- **ID**: Newly generated number for identification
- **IssueInstant**: Timestamp to indicate the time it was generated
- **AssertionConsumerServiceURL**: The SAML URL interface of the service provider, where the Identity provider sends the authentication token.
- **Issuer**: The EntityID (unique identifier) of the service provider
- **InResponseTo**: The ID of the SAML request that this response belongs to
- **Recipient**: The EntityID (unique identifier) of the service provider

## SAML Authentication with Auth0

When it comes to implementing SAML, Auth0 is extremely extensible and able to handle several scenarios:

- Auth0 as the [identity provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider)
- Auth0 as the [service provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-service-provider)
- Auth0 as the [identity and service provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-and-service-provider)

For this example, you'll learn how to implement SAML authentication using Auth0 as the identity provider.

<include src="TweetQuote" quoteText="When implementing SAML, Auth0 can serve as the identity provider, service provider, or both!"/>

### Prerequisites

- **An [Auth0](https://auth0.com/) account** &mdash; If you don't already have one, you can [sign up for a free account here](https://a0.to/blog_signup).

- **An account with a service provider that supports SAML** &mdash; Generally, most service providers require you to have a business account or some paid plan to configure SAML.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

The following image shows a list of the service providers Auth0 supports out-of-the-box, but you also have the option of [**configuring a custom service provider**](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider#manually-configure-a-sso-integration) in the dashboard.

![configuring a custom service provider](https://images.ctfassets.net/23aumh6u8s0i/1oKJfsjlupfnWeTZ013s31/2ab99a5fd2bcc7be780b530d6fdecbb2/03_saml_flow.png)

### Configure the service provider

This tutorial will use [Zendesk](https://zendesk.com/) as the service provider, but you can follow along with any SP of your choice.

To configure your chosen service provider, run through the following steps in your [Auth0 dashboard](https://manage.auth0.com/):

1. Click on SSO Integrations in the sidebar under **account > security**
2. Click on the **blue** button in the top right corner, Create SSO Integration
3. Select **SAML**
4. Enter the name and/or any identifying information required and press Save ![Configure the service provider](https://images.ctfassets.net/23aumh6u8s0i/3x0opMZ7nl5I5UYazGT3dk/c57eae72f111740c979170a80c065cf9/04_saml_flow.png)
5. Follow the instructions under Tutorial for your specific service provider

> **Note**: This step will require you to input some values on the service provider's side.

Here's what that looks like for **Zendesk**.

First, go into the **Admin Center** in the _Zendesk dashboard_ and click on Security. Next, click on SSO, and you'll find the SAML configuration settings. This is where you'll paste in those values from the Auth0 dashboard.

![Zendesk SAML setup](https://images.ctfassets.net/23aumh6u8s0i/3ghqY6FLvOLKAJwUfFTMpD/7d3192482acdb9039642446a5d04a1e9/05_saml_flow.png)

![Auth0 Zendesk tutorial setup](https://images.ctfassets.net/23aumh6u8s0i/3hEM5UYnYgHZ98uzhtKfBm/3546f05a32fac11df4a380fae1e41d5c/06_saml_flow.png)

Once these values are copied over, the last step is to enable external authentication for the users that should be able to login with SAML. Zendesk allows you to enable this for end-users, staff users, or both.

![Zendesk Auth0 end-user external authentication](https://images.ctfassets.net/23aumh6u8s0i/1GSsL2KvJFBlG4nhfqT4s3/67b635d77b4fcbd31c33d39049181700/07_saml_flow.png)

### Test it out

Now that everything is set up on both ends, it's time to test it out! See the video below for a demonstration of what the final flow should look like.

<AmpContent>
<amp-video controls
    layout="responsive"
    width="480" height="270">
    <source src="https://cdn.auth0.com/blog/what-is-saml/zendesk-auth0-demo.mp4"
    type="video/webm" />
</amp-video>
</AmpContent>
<NonAmpContent>
<video controls="controls">
  <source type="video/mp4" src="https://cdn.auth0.com/blog/what-is-saml/zendesk-auth0-demo.mp4" />
</video>
</NonAmpContent>

As you can see, once you go to your Zendesk URL, you're redirected back to Auth0, the identity provider, to sign in. Once authenticated, Auth0 sends this information back to Zendesk. Zendesk verifies the response, determines it valid, and grants you access to your Zendesk dashboard.

> **Note**: You may have noticed that in the video, the user signed in with Google SSO. This can be enabled in the Auth0 dashboard. You'll see how to implement this in the next section.

If you go back to your Auth0 dashboard, you'll now see a record of the user that just signed in.

![Auth0 SAML Zendesk new user login](https://images.ctfassets.net/23aumh6u8s0i/75LHYuDkJSmqGqSFYcGo1c/0be08541c1f08ba6950e8f2568ba5191/08_saml_flow.png)

> **Note**: If you'd like to debug a SAML response, check out [https://samltool.io](https://samltool.io/). This tool can decode a SAML response and serves as a useful debugging resource.

### Enable SSO (optional)

Now that your service provider is set up with Auth0, your users can sign in using an email and password by default. A common use case, especially with SAML authentication, is to have users sign in using single sign-on (SSO) with a social provider.

Auth0 supports several [social identity providers](https://auth0.com/docs/connections/identity-providers-social) that you can enable with the click of a button.

In your dashboard, click on Connections > Social in the sidebar. Select the provider you'd like to use and fill in the details required for that provider.

> **Note**: Make sure you [use your own keys](https://auth0.com/docs/connections/social/devkeys) for the selected provider. You may use the default Auth0 developer keys for testing, but they should not be used in production.

![Auth0 social connections](https://images.ctfassets.net/23aumh6u8s0i/2UTEiyqothV4PS6Ia6F2gp/f2a7e2a5d73ffc09c815149ab3f4c52b/09_saml_flow.png)

Once you've selected the social connections you want to use, go back to the SP you configured under SSO Integrations. Select the SP, and under Connections, you should see the social connection you just created. Click on the switch to enable it, and now your users are ready to sign in with any of the connections listed.

> **Note**: Some SSO integrations are very easy, and simply require the user to enable them as described above; however, a few of the SSO options require additional steps that are specific to the social network. For example, Facebook requires the user to create an app on the Facebook Developers site, and requires some additional fields and steps like supplying an App ID. Some applications may require a review process. While a comprehensive guide to all of these processes is out of scope for this tutorial, each network typically publishes their own guide for configuring SSO. Facebook’s guide can be found here: [Enable single sign-on for your organization’s managed Meta accounts in Admin Center](https://www.facebook.com/help/624731485413747).

![Auth0 SAML SSO connections](https://images.ctfassets.net/23aumh6u8s0i/6NEsKC1MtjzRjkcw7Ur1vz/ab52ae9016b48836218f0ffcf3efef25/10_saml_flow.png)

## More Auth0 SAML Configurations

Auth0 is adaptable when it comes to SAML configuration. Here are some of the other ways you can configure Auth0:

- Configure [Auth0 as a Service Provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-service-provider) in a SAML federation
- SAML Configurations for SSO Integrations such as Google Apps, Hosted Graphite, [Litmos](https://auth0.com/docs/protocols/saml/saml-apps/litmos), [Cisco Webex](https://auth0.com/docs/protocols/saml/saml-apps/cisco-webex), [Sprout Video](https://auth0.com/docs/protocols/saml/saml-apps/sprout-video), [FreshDesk](https://auth0.com/docs/protocols/saml/saml-apps/freshdesk), Tableau Server, [Datadog](https://auth0.com/docs/protocols/saml/saml-apps/datadog), and more
- Configure Auth0 to use other identity Providers such as [Okta](https://auth0.com/docs/protocols/saml/identity-providers/okta), [OneLogin](https://auth0.com/docs/protocols/saml/identity-providers/onelogin), [PingFederate 7](https://auth0.com/docs/protocols/saml/identity-providers/ping7), [SalesForce](https://auth0.com/docs/protocols/saml/identity-providers/salesforce), [SiteMinder](https://auth0.com/docs/protocols/saml/identity-providers/siteminder), and [SSOCircle](https://auth0.com/docs/protocols/saml/identity-providers/ssocircle)
- Configure Auth0 as both the [service provider and identity provider](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-and-service-provider)

![how saml works separator 3](https://images.ctfassets.net/23aumh6u8s0i/3JxeMOsMizQrSavWXxZ3Ud/84c3b1775f4de7ac78860dea7f9aae1b/how-saml-works-3)

## Conclusion

You have covered how SAML authentication works, the benefits SAML provides, and how to implement SAML with Auth0 as the identity provider. If you have any questions, feel free to reach out below.


How SAML Authentication Works

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

arpit-jain

Arpit is a skilled engineering manager and software developer who specializes in Java, JS, and cloud-native technologies. He actively contributes to the developer community and focuses on enhancing the developer experience. Arpit also mentors aspiring developers.

Senior Engineering Manager

Arpit Jain

The Auth0 Terraform provider has many new features and updates. Learn all about what's new.

The [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs) allows you to automate the configuration of Auth0 resources like applications, connections, actions, and more. You can also use it to manage users and groups. With the Auth0 Terraform provider, you can automate almost everything you can do via the management UI.

**Check out our blog post to get started with Auth0 and Terraform.**

<include 
    src="LinkCard" 
    title="Get Started with the Auth0 Terraform Provider" 
    link="https://auth0.com/blog/get-started-with-auth0-terraform-provider/" 
    description="Learn how to get started with the Auth0 Terraform Provider to automate your identity infrastructure." 
    img="https://images.ctfassets.net/23aumh6u8s0i/315vJcTNAjaIgQZWxlovOf/a1839ed3bff28c3da8969642252c86a6/terraform-auth0-logo"
/>

## What's New in the Auth0 Terraform Provider

The latest versions (1.4 to 1.7) of the Auth0 Terraform provider have many new features and updates. Here are the top **six** features to look out for.

### Auth0 Forms

[Auth0 Forms](https://auth0.com/features/forms) is a robust visual editor that enables you to create custom, dynamic forms seamlessly integrating with your authentication workflows.

> [Available from v1.7.3](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/form)

<AmpContent>
  <amp-youtube
      data-videoid="jkzwN2xwO5w"
      layout="responsive"
      width="480" height="270">
  </amp-youtube>
</AmpContent>
<NonAmpContent>
  <div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/jkzwN2xwO5w' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Forms offer a secure and controlled experience within your tenant's domain, eliminating the need for external site redirects. You can manage Auth0 Forms and [Flows](https://auth0.com/docs/customize/forms/flows) via Terraform, enabling you to automate the creation and management of forms and flows.

```hcl
# Create an Auth0 Form
resource "auth0_form" "sample_form" {
  name = "KYC Form"

  start = jsonencode({
    coordinates = { x = 0, y = 0 }
    next_node = "username_step"
  })

  nodes = jsonencode([{
    id   = "username_step"
    type = "STEP"
    config = {
      components = [{
        category = "FIELD"
        config = {
          max_length = 50
          min_length = 1
          multiline  = false
        }
        id        = "full_name"
        label     = "Your Name"
        required  = true
        sensitive = false
        type      = "TEXT"
        },
        {
          category = "BLOCK"
          config = { text = "Continue" }
          id   = "next_button_3FbA"
          type = "NEXT_BUTTON"
      }]
      next_node = "$ending"
    }
    coordinates = { x = 500, y = 0 }
  }])

  ending = jsonencode({
    after_submit = {
      flow_id = auth0_flow.sample_flow.id
    }
    coordinates = { x = 1250, y = 0 }
    resume_flow = true
  })

  style = jsonencode({ css = "h1 { color: white; text-align: center; }" })
}

# Create an Auth0 Flow to use the Form
resource "auth0_flow" "sample_flow" {
  actions = jsonencode([{
    action = "UPDATE_USER"
    allow_failure = false
    id            = "update_user_metadata"
    mask_output   = false
    params = {
      changes = {
        user_metadata = { full_name = "{{fields.full_name}}" }
      }
      connection_id = auth0_flow_vault_connection.sample_connection.id
      user_id       = "{{context.user.user_id}}"
    }
    type = "AUTH0"
  }])
  name = "Flow KYC update data"
}

# Create a Flow Vault Connection to use in a Flow
resource "auth0_flow_vault_connection" "sample_connection" {
  app_id = "AUTH0"
  name   = "Auth0 M2M Connection"
  setup = {
    client_id     = var.auth0_client_id # The M2M app must be authorized to use the Auth0 Management API
    client_secret = var.auth0_client_secret
    domain        = var.auth0_domain # without https:// in the domain
    type          = "OAUTH_APP"
  }
}
```

### Machine-to-Machine Access for Organizations

[Machine-to-Machine (M2M) Access for Organizations](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) enables you to define the organizations that a given application can access for each API using the Client Credentials Flow. This enables customers to sell and operate their services in M2M environments properly, cover scenarios with consumption devices with limited user experience capabilities, and simplify configuration and usage.

This is being implemented so that M2M Apps can be associated with a given organization, as currently done for Connections. This will enable that application to request an access token for that specific Organization.

> Note: This feature is available from B2B Professional, Enterprise, and Enterprise premium plans.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/organization_client_grant)

```hcl
# Create an Auth0 Organization
resource "auth0_organization" "my_organization" {
  name         = "auth0-inc"
  display_name = "Auth0 Inc."

  branding {
    logo_url = "https://example.com/assets/icons/icon.png"
    colors = {
      primary         = "#f2f2f2"
      page_background = "#e1e1e1"
    }
  }
}

# Create a new Auth0 M2M application
resource "auth0_client" "sample_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "non_interactive"
}

# Create a Client Grant for the Client
resource "auth0_client_grant" "my_client_grant" {
  client_id = auth0_client.sample_client.id
  audience  = "https://passkeys-demo.eu.auth0.com/api/v2/"
  scopes    = ["create:foo", "create:bar"]
}

# Create a Client Grant for the Organization
resource "auth0_organization_client_grant" "sample_organization_client_grant" {
  organization_id = auth0_organization.my_organization.id
  grant_id       = auth0_client_grant.my_client_grant.id
}
```

## Bring Your Own Key (BYOK)

[Bring Your Own Key](https://auth0.com/docs/secure/highly-regulated-identity/customer-managed-keys/customer-managed-keys-management-api) allows you to securely replace your tenant’s top-level encryption key with a key of your own, hence gaining control of your key material in Auth0’s hardware security module (HSM). It allows compliance with specific secret custody and key provenance requirements. Once you have uploaded your key, data encryption and decryption operations use that key to encrypt your tenant's secrets and data.

> Note: This feature is available as Early Access on Enterprise plans with the Highly Regulated Identity add-on.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/encryption_key_manager)

```hcl
# Modifying the key_rotation_id causes the keys to be rotated/rekeyed.
resource "auth0_encryption_key_manager" "sample_key_manager_initial" {
  key_rotation_id = "da9f2f3b-1c7e-4245-8982-9a25da8407c4"
}

resource "auth0_encryption_key_manager" "sample_key_manager_rekey" {
  key_rotation_id = "68feba2c-7768-40f3-9d71-4b91e0233abf"
}

# To initialize the process of providing the root key by the customer, create a
# `customer_provided_root_key` block.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
  }
}

# The public_wrapping_key and wrapping_algorithm should be available to
# be used to wrap the new key by the customer
output "key_manager" {
  depends_on = [auth0_encryption_key_manager.sample_key_manager]
  value = {
    public_wrapping_key = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.public_wrapping_key
    wrapping_algorithm  = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.wrapping_algorithm
  }
}

# The root key should be wrapped using the specified algorithm by the customer and Base64 encoded.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
    wrapped_key = "your_base64_encoded_wrapped_root_key"
  }
}
```

## Customize Signup and Login Prompts

[Customize Signup and Login Prompts](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts) is a feature that allows customers with a Custom Domain and Custom Page Template enabled to add custom fields and content to their app’s signup and login prompts.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/prompt_screen_partial)

Customize Signup and Login Prompts supports two use cases.

- **Custom content**: Custom content is static content like text, links, or images placed directly on the signup and login prompts.
- **Data capture**: Data capture uses form elements dynamically added to the signup and login prompts, which is useful for collecting and validating user consent or user-produced data like a surname.

```hcl
# For managing a single prompt screen
resource "auth0_prompt_screen_partial" "login" {
  prompt_type = "login"
  screen_name = "login"
  insertion_points {
    form_content_start = "<div>Form Content Start</div>"
    form_content_end   = "<div>Form Content End</div>"
  }
}

# For managing multiple prompt screens
resource "auth0_prompt_screen_partials" "prompt_screen_partials" {
  prompt_type = "login-passwordless"

  screen_partials {
    screen_name = "login-passwordless-email-code"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }

  screen_partials {
    screen_name = "login-passwordless-sms-otp"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }
}
```

## Self-Service Single Sign-On

[Self-Service Single-Sign On (SSO)](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO) provides business-to-business (B2B) customers with the tools needed to delegate SSO setup to their enterprise customers. This enables your B2B customers to configure and manage their own ways of logging in to your SaaS application.

Self-Service SSO provides a packaged experience that Auth0 customers can offer to their business customers so that they can set up their own SSO access. Customers can take advantage of this time-saving feature to reduce support costs and time-to-value for their business customers.

> Note: This feature is available as limited Early Access on Enterprise plans.

> [Available from v1.5.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/self_service_profile)

```hcl
resource "auth0_self_service_profile" "my_self_service_profile" {
  user_attributes {
    name        = "sample-name"
    description = "sample-description"
    is_optional = true
  }
  branding {
    logo_url = "https://mycompany.org/v2/logo.png"
    colors {
      primary = "#0059d6"
    }
  }
}
```

## SCIM Configuration

[System for Cross-domain Identity Management (SCIM)](http://www.simplecloud.info/), is a [protocol](https://tools.ietf.org/html/rfc7644) and [schema](https://tools.ietf.org/html/rfc7643) used by enterprise organizations for provisioning, de-provisioning, and managing user identity-related information across systems in a standardized way. SaaS developers selling their SaaS apps and services to large enterprises may be asked, or even required, by those customers to implement a SCIM-based API to integrate with the user provisioning tooling they use.

With support for [inbound SCIM](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim), SaaS application builders will be able to:

- Use the Auth0 Dashboard or APIs to quickly and easily enable support inbound SCIM user provisioning and de-provisioning workflows to their Auth0 user identity stores
- Get out-of-box support for top Workforce IDPs that implement outbound SCIM (including Okta Workforce Identity Cloud and Azure AD) without needing to build or self-host any custom endpoints

> Note: This feature is available on Enterprise plans.

> [Available from v1.4.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/connection_scim_configuration)

```hcl
resource "auth0_connection" "my_enterprise_connection" {
  name         = "my-enterprise-connection"
  display_name = "My Enterprise Connection"
  strategy     = "okta"

  options {
    client_id              = "1234567"
    client_secret          = "1234567"
    issuer                 = "https://example.okta.com"
    jwks_uri               = "https://example.okta.com/oauth2/v1/keys"
    token_endpoint         = "https://example.okta.com/oauth2/v1/token"
    authorization_endpoint = "https://example.okta.com/oauth2/v1/authorize"
  }
}

# A resource for configuring an Auth0 Connection SCIM Configuration, specifying `user_id_attribute` and `mapping`.
# Only one can be specified for a connection.
resource "auth0_connection_scim_configuration" "my_conn_scim_configuration" {
  connection_id     = auth0_connection.my_enterprise_connection.id
  user_id_attribute = "attribute1"
  mapping {
    auth0 = "auth0_attribute1"
    scim  = "sacim_attribute1"
  }
  mapping {
    auth0 = "auth0_attribute2"
    scim  = "sacim_attribute2"
  }
}
```

## Learn More

I hope that you found this article helpful. Here are some additional resources to learn more about Auth0 and DevOps.

- [Get Started with the Auth0 Terraform Provider](https://auth0.com/blog/get-started-with-auth0-terraform-provider/)
- Be a DevOps Hero\! Automate Your Identity Infrastructure with Auth0 CLI and Ansible
- [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
- [Shhhh... Kubernetes Secrets Are Not Really Secret\!](https://auth0.com/blog/kubernetes-secrets-management/)
- [Auth0 CLI Basics \- Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything about identity and security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@auth0 on Twitter](https://twitter.com/auth0) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.


What's New in the Auth0 Terraform Provider?

cailyn edwards_24-05-16_OktaASM_3465

Senior Security Engineer

Cailyn Edwards

Everything you need to know about IdPs, from how they work to the benefits of using one.

**TL;DR**: IdPs are services that manage entities' digital identities. They help service providers verify the identity of their users and enable SSO to minimize user password fatigue.

## What Is an IdP?

An Identity Provider (IdP) is a service that stores and manages digital identities. These identities can belong to human or software entities. You can imagine an identity provider like a social register from Regency-era England containing information about specific individuals, including names, titles, and familial connections. This information could be used to dictate who should be invited to which events in high society or even to verify that someone is who they say they are. Modern IdPs probably won’t help you get invited to any major society events, but they do ensure that access to digital services is limited to the intended audience.

### What Do We Mean by Identity?
[**Digital identity**](https://auth0.com/docs/get-started/identity-fundamentals/identity-and-access-management) is the mapping of information about an individual to that person or entity. An identity will consist of user information like a username, address, email, etc. A subset of this information is unique and can be used to validate the identity of the entity it’s mapped to. This subset is what makes up a user's identity factors, which can be things like credentials, biometrics, security questions, or device information. These identity factors fit into three categories: knowledge, possession, and inheritance — in other words, something you know, something you have, and something you are.

## Why Are IdPs Important?

IdPs are crucial in the modern world because they allow entities to access resources securely while ensuring that only the users who are supposed to access them are able to access them. While service providers (SPs) can — and often do — manage identities, they have to balance that specialized service with their standard offerings. IdPs have the advantage of focusing primarily on managing and securely storing identities; thus, they are better suited to work with things like [Single Sign-on (SSO)](https://auth0.com/docs/authenticate/single-sign-on) and [Multi-factor Authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication).

## How Do IdPs Work?

IdPs work by allowing users to log in to a variety of service providers using the authentication factors available to them. IdPs often support using existing credentials, like your Google login or a set of credentials set directly with the IdP.

A typical interaction with an IdP might look like this:

1. User requests to log in to the SP
2. SP redirects the user to the IdP for login
3. User enters credentials (or uses other authentication mechanisms)
4. IdP validates the user and reports back to the SP
5. The user is granted or denied access to the SP’s platform

IdPs also allow SPs to have a high level of control over how they manage access. They can have varied policies depending on the resources being accessed and by whom. These policies and rules are managed by admins, and can be changed and improved upon over time.

## What Are the Different Types of IdPs?

You can have different types of identity providers.

**Social** - Social IdPs are an easy way to validate users with minimal friction, saving the user from creating another password and username combination. An example of a social identity provider is Facebook. Web applications can use Auth0 to leverage a social IdP, allowing users to log in using their Facebook credentials.

**Enterprise** - Enterprise IdPs are often used for SSO. They allow employees to have a single set of credentials to access the variety of services needed to do their job. [Okta](https://www.okta.com/) is an example of an enterprise IdP, allowing employees to sign into any applications they are authorized to use through a convenient dashboard.

**Legal** - Legal IdPs are IdPs managed by governments. This is most common in Europe, but is becoming more prevalent elsewhere as well. An example of a legal IdP is [Criipto](https://www.criipto.com/electronic-identities), which offers eIDs for Denmark, Norway, Sweden, and other European countries.

## What Are the Benefits of IdPs?

Because IdPs are specialized in managing identity, they typically offer higher security and easier integration with multiple SPs.

There are many additional benefits to using an IdP, including:

* **Easier Credential Management**: When users have options like SSO, signing in with social or biometric/device-based authentication means one less set of credentials to manage. This leads to less reuse of easy to remember (and easy to guess) passwords — and a secure, seamless experience.
* **Automated User Onboarding and Offboarding**: With identity managed in one place, it’s easier to grant and revoke permissions at once based on things like group membership.
* **Allows SP to Focus on Core Offerings**: Dedicated identity management empowers service providers to concentrate on their primary business functions. By partnering with expert IdPs, SPs ensure secure identity management while devoting their resources to what matters most to their customers.
* **Better Identity Security**: IdPs have significant field experience, are dedicated to identity management, setting industry standards, and focus on protecting user data.
* **Increased Telemetry**: Identity management is the core product of IdPs, and they treat it as such. An IdP tracks who accessed what and when — which is useful for compliance, audits, and incident response.
* **Multiple Ways to Authenticate**: Users and SPs can choose the authentication options that work best for them, meaning less friction on sign-up and login.
* **Service Agnostic:** If you manage multiple service providers, or a user has worked for multiple tech companies, you will likely have run into the same IdPs. This makes onboarding and management easier — and allows you to leverage your existing knowledge. 

## FAQs

**What’s the difference between an IdP and a Single Sign-On (SSO) provider?**

While an IdP stores and manages digital identities, SSO is an authentication mechanism that allows a single user identity to access multiple service providers. SSO will still use an IdP to verify the user’s identity, and link it to a collection of applications a user can access. Think of an employee dashboard that allows the employee to use their corporate login to access their HR tools, travel planning, email, and so on.

**How do IdPs work with MFAs?**

Service providers can define policies for specific resources and user groups. Many IdPs support specifying the requirement for MFA, what MFAs are supported, and the lifespan of the MFA confirmation in these security policies. Most IdPs have their own MFA options, for example [Okta Verify](https://help.okta.com/en-us/content/topics/mobile/okta-verify-overview.htm).

**Can I move users from my custom-built solution to an IdP?**

Most IdPs will allow the import of users from external applications, allowing you to up your security and reduce your workload in just a few clicks. In the case of Auth0, we can support [automatic migrations](https://auth0.com/docs/manage-users/user-migration), so you can make the switch with little to no impact on your users.

## Conclusion

IdPs are a purpose-built solution that helps both SPs and users access resources securely. They allow SPs to manage granular access policies and reduce the mental load of credential management. IdPs are feature-rich identity and access management solutions, and they’re becoming even more crucial in the ever-evolving technical landscape. If you’re interested in learning about the future of IAM, you can [read about the identity challenges facing AI-powered applications](https://auth0.com/blog/identity-challenges-for-ai-powered-apps/).


What is an IdP (aka Identity Provider)?

Learn how to get started with the Auth0 Terraform Provider to automate your Auth0 configuration.

When managing infrastructure for any large enough organization, you will need to automate the provisioning and configuration of resources, services, and applications. [Terraform](https://www.terraform.io/) has been the de facto standard for infrastructure as code (IaC) for a while now. Terraform's declarative syntax and cross-platform support make it a great choice for managing infrastructure. Terraform is cloud-agnostic and supports all major cloud providers and on-premise setups. It also supports a lot of other services and applications using [providers](https://registry.terraform.io/browse/providers).

If you use Terraform in your organization and want to configure and manage your Auth0 tenants with Terraform, you are in luck because Auth0 has a Terraform Provider. The [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs) allows you to automate the configuration of Auth0 resources like applications, connections, actions, and more. You can also use it to manage users and groups. With the Auth0 Terraform provider, you can automate almost everything you can do via the management UI.

## Overview

So here is what you will learn to do today:

-   Setup the Auth0 Terraform Provider with Auth0 CLI
-   Create a new Auth0 application for OpenID Connect (OIDC) authentication
-   Create roles and users for Auth0
-   Create an action to customize the authentication flow
-   Generate terraform configurations from your existing Auth0 tenant using Auth0 CLI

**Prerequisites:**

-   [Terraform CLI](https://www.terraform.io/downloads) version 1.5+
-   [Auth0 CLI](https://auth0.github.io/auth0-cli/) version 1.1+
-   [jq](https://jqlang.github.io/jq/download/)

## Setup the Auth0 Terraform Provider

Before you can set up the Auth0 Terraform Provider, you need to create a machine-to-machine application in Auth0 so that Terraform can communicate with the Auth0 management API. This can be done using the Auth0 CLI. Install the Auth0 CLI and login to your tenant with the `create:client_grants`.

```bash
auth0 login --scopes create:client_grants
```

> If you don't already have an Auth0 tenant, you can [sign up for a free Auth0 account](https://a0.to/blog_signup) and create a tenant.

Run the following commands to create a machine-to-machine application and extract the client ID and secret from the output.

```bash
# Create a machine-to-machine application on Auth0
export AUTH0_M2M_APP=$(auth0 apps create \
  --name "Auth0 Terraform Provider" \
  --description "Auth0 Terraform Provider M2M" \
  --type m2m \
  --reveal-secrets \
  --json | jq -r '. | {client_id: .client_id, client_secret: .client_secret}')

# Extract the client ID and client secret from the output.
export AUTH0_CLIENT_ID=$(echo $AUTH0_M2M_APP | jq -r '.client_id')
export AUTH0_CLIENT_SECRET=$(echo $AUTH0_M2M_APP | jq -r '.client_secret')
```

> The environment variable names should be exactly as above, as the Terraform provider expects these variables to be set.

The commands above will create the application and set environment variables for the client ID and secret.

This application needs to be authorized to use the Auth0 management API. This can be done using the commands below:

```bash
# Get the ID and IDENTIFIER fields of the Auth0 Management API
export AUTH0_MANAGEMENT_API_ID=$(auth0 apis list --json | jq -r 'map(select(.name == "Auth0 Management API"))[0].id')
export AUTH0_MANAGEMENT_API_IDENTIFIER=$(auth0 apis list --json | jq -r 'map(select(.name == "Auth0 Management API"))[0].identifier')
# Get the SCOPES to be authorized
export AUTH0_MANAGEMENT_API_SCOPES=$(auth0 apis scopes list $AUTH0_MANAGEMENT_API_ID --json | jq -r '.[].value' | jq -ncR '[inputs]')

# Authorize the Auth0 Terraform Provider application to use the Auth0 Management API
auth0 api post "client-grants" --data='{"client_id": "'$AUTH0_CLIENT_ID'", "audience": "'$AUTH0_MANAGEMENT_API_IDENTIFIER'", "scope":'$AUTH0_MANAGEMENT_API_SCOPES'}'
```

> If you don't want to authorize all scopes for the Terraform Provider, you can filter the required scopes from the output of `auth0 apis scopes list` and pass it to the `auth0 api post` command in place of `$AUTH0_MANAGEMENT_API_SCOPES`. Make sure to pass a valid JSON array of strings.

Now, you can set up the Auth0 Terraform Provider. First, make sure you use a specific version of the providers, as different versions might use different attributes and features. Create a `versions.tf` file:

```bash
mkdir terraform
cd terraform
touch versions.tf
```

Add the following to the file:

```hcl
terraform {
  required_version = ">= 1.7.0"

  required_providers {
    auth0 = {
      source  = "auth0/auth0"
      version = "~> 1.1.2" # Refer to docs for latest version
    }
    ## Add other providers here
  }
}
```

Next, you need to define variables and [configure the provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs#schema). Create a `config.tf` file:

```bash
touch config.tf
```

Add the following to the file:

```hcl
variable "auth0_domain" {
  default     = "https://<your_auth0_domain_uri>"
  description = "Auth0 domain"
}

provider "auth0" {
  domain        = var.auth0_domain
  debug         = false
}
```

You can find your Auth0 domain in the [Auth0 dashboard](https://manage.auth0.com/) or by running the `auth0 tenants list` command.

Now, you can initialize the Terraform workspace and test the provider by running the following commands:

```bash
terraform init
```

## Create an Auth0 Application

Let's get into business. Create a Terraform script that creates an Auth0 web application and required customizations. Create a file named `auth0.tf` in the `terraform` folder and add the following content:

```hcl
# Create a new Auth0 application for OIDC authentication
resource "auth0_client" "oidc_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "regular_web"
  callbacks           = ["http://localhost:8080/callback"]
  allowed_logout_urls = ["http://localhost:8080"]
  oidc_conformant     = true

  jwt_configuration {
    alg = "RS256"
  }
}

# Configuring client_secret_post as an authentication method.
resource "auth0_client_credentials" "oidc_client_creds" {
  client_id = auth0_client.oidc_client.id
  authentication_method = "client_secret_post"
}
```

The script above does the following:

-   The `auth0_client` resource definition creates an Auth0 Web application client conforming to the OIDC standard.
-   The `auth0_client_credentials` resource definition configures the client to use the `client_secret_post` authentication method (confidential client using HTTP POST parameters). Other supported methods are:
    -   `none`: Public client without a client secret
    -   `client_secret_basic`: Confidential client using HTTP Basic
    -   `private_key_jwt`: Confidential client using a Private Key JWT

> Refer to the [`auth0_client` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/client) and [`auth0_client_credentials` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/client_credentials) for all possible configurations.

Next, you can also define some outputs to be captured. Create a `outputs.tf` file:

```bash
touch outputs.tf
```

Add the following to the file:

```hcl
output "auth0_webapp_client_id" {
  description = "Auth0 JavaMicroservices Client ID"
  value       = auth0_client.oidc_client.client_id
}

output "auth0_webapp_client_secret" {
  description = "Auth0 JavaMicroservices Client Secret"
  value       = auth0_client_credentials.oidc_client_creds.client_secret
  sensitive   = true
}
```

Now, you can run the Terraform script to create the Auth0 application. Run the following commands to plan and apply it.

```bash
# see a preview of what will be done
terraform plan
```

Review the plan and make sure everything is correct.

Now you can apply the changes:

```bash
terraform apply
```

You will see the configurations being applied and the output variables printed to the console.

Go to [Auth0 dashboard](https://manage.auth0.com/) and check **Applications** > **Applications**. You should see the application created. You can also find the application using the Auth0 CLI with the `auth0 apps list` command.

If you want to get the client ID and secret from the output, you can run the following command:

```bash
# Client ID
terraform output --json | jq -r '.auth0_webapp_client_id.value'
# Client Secret
terraform output --json | jq -r '.auth0_webapp_client_secret.value'
```

You can update the allowed callback URLs and allowed logout URLs in the Auth0 web application. You can do this by adding the values to the `callbacks` and `allowed_logout_urls` array in the `oidc_client` resource in the `auth0.tf` file like below:

```hcl
resource "auth0_client" "oidc_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "regular_web"
  callbacks           = ["http://localhost:8080/callback", "http://another-domain/callback"]
  allowed_logout_urls = ["http://localhost:8080", "http://another-domain"]
  oidc_conformant     = true

  jwt_configuration {
    alg = "RS256"
  }
}
```

Run `terraform apply -target="auth0_client.oidc_client"` to update the configuration in your Auth0 tenant.

## Create Roles and Users

You can create roles and users using the Auth0 Terraform provider. Let's create some roles and users, and then let's assign the roles to the users.

Add the following content to the `config.tf` file to get a default password while applying the Terraform script:

```hcl
variable "default_password" {
  # Should be a strong password. Example: lkjhasdf$12$12
  description = "Default password for all users"
  sensitive   = true
}
```

Add the following content to the `auth0.tf` file:

```hcl
# Create a role for admin users
resource "auth0_role" "admin" {
  name        = "ROLE_ADMIN"
  description = "Administrator"
}

# Create a role for regular users
resource "auth0_role" "user" {
  name        = "ROLE_USER"
  description = "User"
}

# Create an admin user
resource "auth0_user" "admin_user" {
  connection_name = "Username-Password-Authentication"
  name            = "Jane Doe"
  email           = "jane@test.com"
  email_verified  = true
  password        = var.default_password
}

# Assign roles to the admin user
resource "auth0_user_roles" "admin_user_roles" {
  user_id = auth0_user.admin_user.id
  roles   = [auth0_role.admin.id, auth0_role.user.id]
}

# Create a regular user
resource "auth0_user" "regular_user" {
  connection_name = "Username-Password-Authentication"
  name            = "John Doe"
  email           = "john@test.com"
  email_verified  = false
  password        = var.default_password
}

# Assign roles to the regular user
resource "auth0_user_roles" "regular_user_roles" {
  user_id = auth0_user.regular_user.id
  roles   = [auth0_role.user.id]
}
```

Refer to the [`auth0_role` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/role) and [`auth0_user` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/user) for all possible configurations. [`auth0_role_permission`](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/role_permission) and [`auth0_role_permissions`](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/role_permissions) resources can be used to manage permissions for roles.

Run the following commands to plan and apply the changes:

```bash
terraform plan
#  Verify the plan
terraform apply
```

Provide a default password when prompted. You can find the user IDs in the output.

## Create an Action to Customize the Authentication Flow

One of the most powerful features of Auth0 is the ability to customize the authentication flow using [Actions](https://auth0.com/docs/actions). Actions are custom code that runs during the authentication flow. Actions can be used to add custom claims to the ID and access tokens, custom logic to the authentication flow, and more. You can use the Auth0 Terraform provider to create and manage actions.

Let's create an action that adds the roles to the ID and access tokens. Add the following content to the `auth0.tf` file:

```hcl
# Create an action to add the roles to the ID/access token claims.
resource "auth0_action" "roles_action" {
  name    = "add_roles_claim"
  runtime = "node18"
  deploy  = true
  code    = <<-EOT
  /**
   * Handler that will be called during the execution of a PostLogin flow.
   *
   * @param {Event} event - Details about the user and the context in which they are logging in.
   * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.
   */
   exports.onExecutePostLogin = async (event, api) => {
     const namespace = 'https://www.cooldomain.com';
     if (event.authorization) {
         api.idToken.setCustomClaim(namespace + '/roles', event.authorization.roles);
         api.accessToken.setCustomClaim(namespace + '/roles', event.authorization.roles);
     }
   };
  EOT

  supported_triggers {
    id      = "post-login"
    version = "v3"
  }
}

# Attach the action to the login flow
resource "auth0_trigger_actions" "login_flow" {
  trigger = "post-login"

  actions {
    id           = auth0_action.roles_action.id
    display_name = auth0_action.roles_action.name
  }
}
```

Refer to the [`auth0_action` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/action) for all possible configurations.

Plan and apply the changes:

```bash
terraform plan
#  Verify the plan
terraform apply
```

## Generate Terraform Configurations from Your Existing Auth0 Tenant Using Auth0 CLI

You may already have an existing Auth0 tenant with applications, connections, users, and more. You can use the [Auth0 CLI to generate Terraform configurations](https://registry.terraform.io/providers/auth0/auth0/latest/docs/guides/generate_terraform_config) from your existing Auth0 tenant. Run the following command to generate the Terraform configurations from the above setup:

```bash
export AUTH0_DOMAIN=<your-auth0-domain>
auth0 tf generate --output-dir tmp-auth0-tf
```

This will create the below files in the `tmp-auth0-tf` folder:

-   `auth0_import.tf`: [Terraform configurations to import](https://developer.hashicorp.com/terraform/language/import) the existing resources into the Terraform state.
-   `auth0_main.tf`: Terraform configurations for the Auth0 Terraform Provider. _You may want to update the `required_version` to match the Terraform CLI version you are using._
-   `auth0_generated.tf`: Terraform configurations for the resources in the Auth0 tenant.
-   `terraform`: A specific version of the Terraform binary used for the import. _You can use this binary to run terraform commands if you don't want to update `required_version` in `auth0_main.tf`._
-   `.terraform*`: Terraform state files.

Now, you can import the existing resources into the Terraform state. Run the following commands:

```bash
cd tmp-auth0-tf
terraform apply # You can use your local Terraform CLI if you have updated `required_version` in `auth0_main.tf` else run `./terraform apply`
```

You can verify the generated configurations by running `terraform plan`.

```bash
# You can remove the import file as it's no longer needed.
rm auth0_import.tf
terraform plan
```

The output should be `No changes. Your infrastructure matches the configuration.`

> Note that the `auth0 tf generate` command cannot import sensitive values like secrets and keys.

> Note that this feature is available only from version 1.1+ of the Auth0 CLI, and Terraform import is supported only from Terraform version 1.5+.

## Tear Down the Cluster with Terraform

Once you are done with the tutorial, you can delete all the resources created using Terraform by running the following command:

```bash
terraform destroy
```

## Learn More about Terraform, Auth0, and DevOps

If you want to learn more about Terraform, Auth0 Actions, and DevOps, check out these additional resources.

-   [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
-   [Shhhh... Kubernetes Secrets Are Not Really Secret!](https://auth0.com/blog/kubernetes-secrets-management/)
-   [Auth0 CLI Basics - Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)
-   [Assigning a Default Role to Users on Sign-Up with Auth0 Actions](https://auth0.com/blog/assign-default-role-on-sign-up-with-actions/)
-   [Ensure Users Log in from Trusted Networks with Auth0 Actions](https://auth0.com/blog/ensure-users-log-in-trusted-networks-auth0-actions/)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything related to Identity and Security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@oktadev on Twitter](https://twitter.com/oktadev) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.

Get Started with the Auth0 Terraform Provider

Majid Hajian

I am a Google Developer Expert and Media Developer Expert and a passionate software developer with years of developing and architecting complex web and mobile applications. my passions are Flutter, PWA, and performance. I love sharing my knowledge with the community by writing and speaking, contributing to open source, and organizing meetups and events.

Google Developer Expert

In this tutorial, you’ll learn how to enhance your Flutter apps by enabling authentication, supporting federated identity providers, adding authorization by introducing roles and permissions, all leveraging Auth0.

In the exercise from the previous section, you added Auth0 authentication to an existing Flutter app. This added a username/password authentication flow to the app. You also gave the app the ability to request and submit refresh tokens, which enhance the user experience by not requiring the user to authenticate every time they use the app.

This section will expand on the app by examining some useful Auth0 features:

* Refresh token rotation
* Social logins
* Managing your Auth0 account

> **Look for the 🛠 emoji if you’d like to skim through the content while focusing on the build and execution steps.**


## Add Refresh Token Rotation

When the app makes an authentication request to Auth0’s authentication server, it includes the `offline_access` scope. This causes the authentication server to issue a refresh token, which the app can use to re-authenticate without requiring the user to log in again. The app stores this token in the device’s secure storage.

While this enhances the app’s user experience, it also introduces risk. The refresh token is long-lived, and the app could use it as a “lifetime pass” to endlessly request new access tokens and keep the user logged in forever.

I highly recommend taking advantage of *Refresh Token Rotation* and *Automatic Reuse Detection* to help mitigate this risk. With these features enabled, each refresh token can be used only once. When the app exchanges its refresh token for a new access token, the authentication server also returns a new refresh token and invalidates the old one. 

Let’s enable these features!

🛠 Navigate to the **Applications** section of your Auth0 dashboard, select the **MJ Coffee** application, and then select its **Settings** tab. Scroll down the page to the **Refresh Token Rotation** section and turn on the **Rotation** and **Absolute Expiration** options:

![Turn on the “Rotation” and “Absolute Expiration” options.](https://images.ctfassets.net/23aumh6u8s0i/6EizPZZnkGjxoAOle1Q8eL/e06c99f4a49413572736bbf0f470436c/rotation_and_absolute_expiration.png)

It is recommended that you issue a refresh token that expires after a preset lifetime. The refresh token’s lifetime can be extended each time one is used to get a new access token or access token/refresh token pair.

There are two options for token lifetimes, and they can be set independently of each other:

- **Absolute Lifetime:** Enabling **Absolute Expiration** sets a specified *absolute lifetime* for the application’s refresh tokens. Refresh tokens can be exchanged for new access tokens during this lifetime. Once the token’s age goes past its lifetime, the user will need to re-authenticate in order to get a new access token. If **Absolute Expiration** is disabled, the refresh token has an indefinite absolute lifetime.
- **Inactivity Lifetime:** Enabling **Inactivity Expiration** specified *inactivity lifetime* for the application’s refresh tokens. Refresh tokens can be exchanged for new access tokens if the user is active in the application during this lifetime. If the user is inactive in the application for a period longer than the inactivity lifetime, they will need to re-authenticate in order to get a new access token.

🛠 Scroll to the bottom of the page and click the **Save Changes** button:

![The “Save Changes” button. The user is directed to click it.](https://images.ctfassets.net/23aumh6u8s0i/7KsLW4adJ6PNIPAI12al4g/f2c0e8abf6d7377595cfb7df11493e67/save_changes.png)


## Social Logins

These days, it's pretty common to have login methods beyond the standard username/password combination. These include logging in with social media account, which will significantly enhance your users’ experiences.

Implementing these additional login methods and adding them to your authorization server is time-consuming and will come with many considerations and risks. 

Luckily, Auth0 provides lots of integration with well-known third parties’ authentication systems, and even allows you to write your custom connections. Let's add connections to both Google’s and Apple’s authentication systems.


### Create a Google/Gmail social connection

🛠 In the Auth0 dashboard, select **Authentication** in the left column menu, then select **Social**. This takes you to the **Social Connections** page, where you should click the **Create Social Connection** button:

![The steps to create a new social connection in Auth0](https://images.ctfassets.net/23aumh6u8s0i/61w1eXrbY7bGOpNo6ODbaU/da810c63bacd28cabf71e6dee4baa349/create_social_connection.png)

You will be taken to the **New Social Connection** page, which has a list of social login providers that integrate with Auth0. 

🛠 Select **Google**:

![Selecting Google from all the available social connections](https://images.ctfassets.net/23aumh6u8s0i/2YdUxIkwmCTcc9QFlo584q/22f7fd0bf4bc1c93c4ebc555e21009f8/select_google.png)

You will now be on the  **New Google / Gmail Social Connection** page, which tells you what kind of user information is accessed by Google social login.

🛠 Click **Continue**:

![Initial page for creating a new Google/Gmail social connection](https://images.ctfassets.net/23aumh6u8s0i/2SQwtF0vqtXJucnGbE3DNS/baf5bd9d7103a6ecbd59b879bbe2aaf4/click_continue.png)

A new page with a number of fields will appear; this is the connection’s **Settings** tab. 

As long as you’re working in a development environment, you only need to fill the **Name** field (which provides a name for this connection) and leave all the other fields empty. You can always use the default value in the **Name** field:

![New Google/Gmail social connection](https://images.ctfassets.net/23aumh6u8s0i/7Jzsn4ryILOOdACN2urlSo/fdaa205ef09352c0b9aba0acbd592977/new_google_gmail_social_connection.png)

However, production apps require you to provide a **Client ID** and **Client Secret** ([doc](https://auth0.com/docs/connections/social/google)) and specify the **Allowed Mobile Client IDs**. These topics will be covered in another video or article.

🛠 Create the Google/Gmail connection by scrolling to the bottom of the page and clicking **Create**:

![Creating the Google/Gmail connection](https://images.ctfassets.net/23aumh6u8s0i/4S8AJUaj4xehVwVxhNDt5X/69eb88b8bec557d310d0e9d678fe9b7e/click_create.png)

This will create the connection, and you’ll be taken to its **Applications** tab. You’ll see a list of your applications, which will allow you to enable the Google/Gmail connection for any of them. Enable the connection for the *MJ Coffee* application:

![The Google/OAuth2 applications tab](https://images.ctfassets.net/23aumh6u8s0i/681u1RRcha4ABJJ5GRZivy/c7eea90ca4e19ec5ab3b333caa47e5ba/google-oauth2_applications_tab.png)

You may also set more permissions that the end-user will need to approve during authorization. These permissions depend on your application and what you want to do on behalf of the user. The *MJ Coffee* app doesn’t need any extra permissions beyond the basic and extended profile.

![Google Permission](https://images.ctfassets.net/23aumh6u8s0i/13CvLX8tQUTuqU6jpZ6K94/a0eaac13b8fc83fc11b3ca3f6651ebd9/google_permissions.png)

🛠 Make sure you sync user profile attributes at each login and hit the **Save** button.


### Create an Apple ID social connection

🛠 Once again in the Auth0 dashboard, select **Authentication** in the left column menu, then select **Social**. This takes you to the **Social Connections** page, where you should click the **Create Social Connection** button:

![The steps to create a new social connection in Auth0](https://images.ctfassets.net/23aumh6u8s0i/1sohaZxDHuq8X8ZvT5nhvE/d2b7a7e2647708327f8fc6971ddb43a9/create_connection.png)

🛠 This time, select **Apple**:

![Selecting Apple from all the available social connections](https://images.ctfassets.net/23aumh6u8s0i/3JAgbtDSNOsfYrjxkE1wCI/e51d80f7418706c29cd6e9dc06b93719/select_apple.png)

You will now be on the  **New Apple Social Connection** page, which tells you what kind of user information is accessed by Apple social login.

🛠 Click **Continue**:

![Continue](https://images.ctfassets.net/23aumh6u8s0i/3zt2ntLwoHwp6bldLmOOsD/8db3e7f5c057d5782c7202b748013420/click_connect_-_apple.png)

As long as you’re working in a development environment, you can leave the **Client ID** and **Client Secret Signing Key** fields empty. You *will* need proper keys for those fields when the app goes to production; [this document covers that topic in more detail](https://auth0.com/docs/connections/apple-siwa/set-up-apple).

The **Apple Team ID** and **Key ID** values are required:

![Google Permission](https://images.ctfassets.net/23aumh6u8s0i/2qNvT5zkxB1TY06ywkH5Re/7c46fa1399743de9e7bb05d1d804fab0/apple_dev.png)

* To get your Apple Team ID, you need an Apple Developer Account.
* To get a Key ID for your app, you need to register that app using your Apple Developer Account. 

🛠 Sign in to your Apple Developer Account, and go to the **Membership** page and make a note of your Team ID.

🛠 If you have a registered app, you can skip the following steps and jump to the list of tasks for creating a service ID. Otherwise, follow the steps below:

- In the Apple Developer Portal, go to **Certificates, IDs, & Profiles > Identifiers** and click the blue “plus” icon next to **Identifiers** to create a new App ID.
- Choose **App IDs** as the identifier type and click **Continue**.
- Provide a description and a Bundle ID in reverse-domain name format (e.g.: `com.mydomain.mjcoffee`).
- Scroll down and check **Sign In with Apple**.
- Click **Continue**, and then click **Register**.

🛠 Once the app is registered, it’s time to create a service ID:

- Return to the **Certificates, IDs, & Profiles** section, and click the blue “plus” icon next to **Identifiers**.
- Choose **Service IDs** and select **Continue**. Fill in the description and identifier (e.g.: `com.mydomain.mjcoffee`).
- After checking **Sign In with Apple**, select **Configure**, and define your Web Domain (e.g.: `com.mydomain.mjcoffee`) and your "Return URL". Ensure that your Return URL is your Auth0 domain and that it follows this format: `https://YOUR_AUTH0_DOMAIN/login/callback`.

![Return URL apple sign in](https://images.ctfassets.net/23aumh6u8s0i/5Wetff0Tutv55UXsYz0gKq/ab19cd3e48604aea314410d22d194982/callback_apple.png)

🛠 Finally: save, continue and then register the service.


#### Set up your Client Secret Signing Key

🛠 Follow these steps:

- Go to **Keys**, which is located in the **Certificates, Identifiers, & Profiles** section of your Apple developer dashboard.
- Select the blue “plus” icon to add a new key.
- Enter a **Key Name** and check the **Sign In with Apple** option.
- Select **Configure** to make sure the **Choose a Primary App ID** field is filled with the correct App ID.
- Select **Save, Continue**, and then **Register**.
- On the page to which you're redirected after registering, make a note of the Key ID. Then download the key; it will have a `.p8` filename extension.

🛠 Go back to your Apple social connection settings and paste the Key ID. Ensure the proper attributes are selected (Name, Email) and sync user profile at each login is enabled. Hit **Save**.


## Enable Social Connections

🛠 Once you have created all your social connections and set them up correctly, go back to your applications. Go to the **Connections** tab and enable your newly-made social connections:

![app social connections](https://images.ctfassets.net/23aumh6u8s0i/59SCRbiX055qDcmTSNwPVl/fa175f974ceb43515893f24f7747d549/app_social_connections.png)

As you can see, adding and removing social connections for your apps is now as simple and flicking a switch.

On the Flutter side, I have good news: you don’t need to implement anything there! 

Restart the app, log out, then try to log in. You’ll see this:

![app social connections](https://images.ctfassets.net/23aumh6u8s0i/4b6BIaeZ8EHcN1a3MYVOrF/91c9039cf0d56051c99397d1a7524a3e/social_buttons_flutter.png)

That's it! The login screen will now display social login buttons, and their login flows will be ready to use.


## Branding 

While it’s fine to use the default branding in development, you want the login page to be customized to your “look and feel” once the app’s in production.

Auth0 allows you to customize your login page through a number of options. You can change the look and feel of the login page by adding colors and logos, and you can customize the user notification part of the process as well: email templates, text messages, and so on. It’s all in the **Branding** section of the Auth0 dashboard:

![Auth0 branding](https://images.ctfassets.net/23aumh6u8s0i/7oq6VzFQ3nSUcStZTXvjQu/38d1e272f3bef751d9feaca704d580dc/branding.png)


### Add Roles

You may want to provide certain functionalities to the user based on their roles. This is easy with proper authorization server such as Auth0, which facilitates adding roles and specifying what users in each role are allowed to do. 

In the MJ Coffee app, there are three different roles:

- **Admin:** These are administrators, and they will have access to all the app’s functionality with full permissions.
- **Customer:** This is the default role for registered or logged-in users. They are limited to the app’s customer-facing features. You will automatically assign this role to all users upon registration or login, and you will learn how to do so later on in this tutorial.
- **Employee:** These are coffee shop employees. They can access the community screen to answer customer requests in the support chat, as well as other employee-facing features.

![Auth0 roles](https://images.ctfassets.net/23aumh6u8s0i/7nVdiU86TPCF1tLXrBg6ID/54a078bfe7d2382a6776c26adfc5cba4/roles.png)

You can add more roles to the app as the need arises.


## User Management in Auth0

Auth0 provides the infrastructure to store users and their information on its cloud database.

For the *MJ Coffee* app, Auth0’s cloud database is sufficient. One of Auth0’s goals is to reduce the cost of extra infrastructure maintenance and cost.

You can access users by selecting **User Management** in the left column menu of the Auth0 dashboard. The **Users** page allows you to create new users and manage your existing ones by changing their details, adding permissions and roles, or revoking their access.

![Auth0 users](https://images.ctfassets.net/23aumh6u8s0i/3O0JDGBqXHmPfrKaEavP2D/260c804cf50a308e696ecd9a446ab4a9/users.png)

When you open a user, you’ll see that Auth0 provides in-depth details about that user, including basic account data, metadata, their devices, and their history, which might be pretty helpful for debugging the application or investigating a particular user’s access activity, permissions, and roles.

![Auth0 user roles](https://images.ctfassets.net/23aumh6u8s0i/JcGTMspZ9hKtu9RAi4Oq9/257a692aa9a65cd12e96f645b56aafd1/user_roles.png)

Each user account stores some basic information about the user: name, email address, the date and time when the account was created, and so on. 

Additional information can be attached to a user by adding to these metadata stores:  their user metadata, which is a key-value structure for storing information about the user. You can also store information in the user_metadata or manipulating `app_metadata`, which helps to provide more information to the Flutter application while receiving user details.


## Moving Forward

In the next section of this tutorial, you will learn how to add real-time chat to the app.


Flutter Authentication and Authorization with Auth0, Part 2: Refresh Tokens, Social Logins, and More

Flutter Authentication and Authorization with Auth0, Part 1: Adding Authentication to an App

1Vitor de Sousa_Auth0

As Regional Vice President, Vitor de Sousa supports Okta and Auth0's German customers in achieving their Identity and Access Management goals. With more than 20 years of experience in the consumer goods industry, as well as in technology and software sales, he develops strategically smart and creative solutions for the interplay of identity authentication, customer experience, and data protection.

Regional Vice President, Enterprise Sales - Germany

Vitor de Sousa

Partnering with a provider to centralize identity lets you maintain control over your data without compromising user experience

Consumers expect the web apps and services they use to be intuitive while also requiring secure and private transactions and a low-friction experience. A good example of this is the increasing demand for biometrics, the use of a person’s physical attributes like a fingerprint or face scan to prove identity and control access. Consumers have become accustomed to the security and convenience that using a fingerprint to unlock their smartphone offers, so using the same technology to secure your web app is an intuitive way to help secure their account data.

[Auth0’s recent global survey](https://info.auth0.com/erwartungen-und-realitat.html), including more than 2,000 consumers and 200 IT/marketing decision-makers in Germany, found that 31% of German consumers are more likely to sign up for a service if it offers biometric authentication. Yet only 17% of German businesses offer this feature. SO biometric authentication is one way for businesses in the DACH region to better align themselves with their customers’ expectations for security without compromising their customer experience (CX). 

Partnering with an [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider who understands how to combine an intuitive user interface with strong security measures like that offered by biometrics can bring additional benefits to your organization. For example: freeing your in-house development talent to focus on your core product, helping you meet regional data privacy regulations, and maintaining active control over your user data.

## Let Your Internal Talent Focus on Your Core Product

Germany is not only the largest economy in the EU; it is also home to the largest software developer talent pool in the region. [As of 2019](https://www.cbi.eu/market-information/outsourcing-itobpo/software-development-services/market-potential), there were more than 900,000 developers in the country, with a majority describing themselves as [Full-Stack front-end developers](https://insights.stackoverflow.com/survey/2021). To ensure your in-house dev teams can focus on those strengths, don’t distract them with an identity project. At Auth0, identity is our core product. Our teams built, maintained, and enhanced a Customer Identity and Access Management (CIAM) platform that incorporates industry security standards, an expert understanding of regional data privacy regulations, and a highly customizable set of integrations to bring you exactly the right mix of security, privacy, and CX.

Our identity specialists bring their expertise and knowledge to secure your authentication and authorization processes while also bringing your customers the tailored, low-friction CX they expect. That allows us to help you build a solution that will be capable of incorporating your needs in the present — while remaining extensible enough to scale with your plans for the future. 

The centralized identity solution you build will unify authentication for your platforms, services, and web apps. This single source of truth (SSoT) for your customer identity data is easier to secure than disparate, siloed data stores for each system. It also limits your attack surface by eliminating multiple access points and login boxes. 

By partnering with Auth0, you get a centralized identity platform that’s ready to be customized by your developers to meet your precise requirements. And our extensibility allows that platform to be readily extended to cover all of your existing properties, whether they’re modern cloud-based apps or legacy on-prem systems.

## Understanding Data Privacy Regulations in The DACH Region

EU Member States are allowed to enact national privacy rules to supplement, specify, and modify the GDPR rules as applied to their citizens. It’s important that companies familiarise themselves with these rules that often govern specific situations.

This document is not intended to act as legal advice. Please consult your legal counsel to ensure you are in compliance with all applicable data privacy laws and regulations.

The right to privacy is well established and respected in the DACH region, where such legislation existed long before the GDPR. Today there are additional rules such as the new German Privacy Act (BDSG-new) along with industry-specific regulations for, e.g., telecommunications, banking, and energy. In Austria, too, we see local regulations like the [Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (DSG)](https://www.dataguidance.com/notes/austria-data-protection-overview), all designed to put the privacy rights of citizens first.

[Switzerland](https://www.dataguidance.com/notes/switzerland-data-protection-overview) has a slightly different take on data protection regulations as well. In addition to GDPR, there are two additional laws that impact data collection and processing there. The first is Article 13 of the Swiss Constitution, which protects Swiss citizens’ rights to privacy in personal and family life, as well as within the home. Meanwhile, the Federal Act on Data Protection (FADP) solidified the language governing how those rights are protected in regards to digital data. Unless you have a team of lawyers and governance specialists for your developers to work with, making sure you’re in full compliance with all of these regulations will soak up a lot of internal resources. Partnering with an IDaaS provider can alleviate these additional strains by taking on the task of helping to assure compliance.

The DACH data privacy landscape can seem complex, and the responsibility for coding privacy into your applications often falls to the people building them. By partnering with Auth0, your developers can help you protect your customer’s personal information without becoming privacy experts themselves. Auth0’s key privacy-enabling features include:

* Easy access to user profiles to enable removal requests
* To export a user’s data in JSON format for data portability
* To enable Log Streaming for continuous security monitoring
* The knowledge that your data is stored locally at an AWS facility in Frankfurt

## Great Customer Experience Includes Choices for Data Location

Part of ensuring your customers get the experience they expect is maintaining control over the data they share when they create an account. Consolidating that data into an SSoT simplifies continuously monitoring its security and detecting threats and other anomalies. Having choices with respect to the location where your data is stored is another asset of partnering with an IDaaS provider like Auth0.

### Data security certification

Auth0 brings knowledge of [regional privacy regulations](https://auth0.com/docs/compliance/gdpr), along with internationally recognized certifications from organizations such as the International Standards Organization (ISO) [27001](https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en) and [27018](https://www.iso.org/standard/61498.html), along with a[ SOC 2 Type II audit](https://auth0.com/blog/auth0-achieves-soc-2-certification/). These are third-party verified certifications, meaning a specialized auditing body has signed off on the security of our processes, infrastructure, [platform](https://assets.ctfassets.net/kbkgmx9upatd/2KxmM5BICQ4GKgeIwA0sKu/d4f59bd579803593edcd571f1aa92ef0/Auth0_Platform_Operations.pdf), policies, and continuous monitoring framework. Auth0 complies with [additional regulations](https://auth0.com/de/security) as well, BaFin, EBA, and HIPAA for example. 

### Customizable user interfaces

[Auth0 Marketplace](https://marketplace.auth0.com/) offers integrations with major line-of-business software, while our [Actions](https://auth0.com/actions) capability allows your developers to work with these integrations with everything from drag and drop to a full Javascript editor. This ease of integration and customization means you can create your login box once and use it across properties.

### All your user data in one place

Being cloud-native gives Auth0 the flexibility to offer multiple data storage options. Access is a key piece of data residency. For organizations in the DACH region, we offer [private cloud deployment options on Microsoft Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) or AWS infrastructure, as well as public cloud options using an AWS facility in multiple regions such as Frankfurt to help our customers achieve compliance. 

### Iterative deployment to ensure buy-in across the organization

Deploying a new identity and access management system can be a lengthy and complex process from a business perspective. Partnering with Auth0 and taking advantage of our identity experts allows for an iterative deployment and a smooth migration that does not jeopardize the user experience by offering frictionless user migrations without password resets. That way, each department or product team can witness a successful roll-out before giving their buy-in without straining your in-house talent. Cross-departmental collaboration is key to any software project, particularly when that software controls data access, and having a successful proof-of-concept (POC) in hand can help secure buy-in as you move forward.

Work with an identity partner that understands your need for a great digital experience without compromising the security and privacy of your customer data. [Reach out to our identity experts](https://auth0.com/contact-us) when you’re ready to continue the conversation or to find out how to start working with Auth0 today.


Centralize Identity For Security and Customer Experience

agustina-ruiz

As Latam Public Relations Manager, Agus supports the public relations and global communications efforts for Auth0 in the Latam region. In her personal time, she is a proud mother of three and has many hobbies such as cooking, skiing and pottery among others.

Public Relations Manager - LATAM

Agustina Ruiz

Leading LATAM identity providers support Mexico’s top companies with identity management and security needs

**BUENOS AIRES, Argentina – Nov. 17, 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), announced today a new partnership with [TEC360](http://www.tec360cloud.com/), a leading provider of cloud solutions for enterprises in Mexico and Latin America (LATAM). TEC360 is Auth0’s first partner in Mexico, and together, the two companies are helping enterprises across the region meet their evolving identity management and security goals.

TEC360 operates in Mexico and LATAM and provides cloud solutions for enterprises’ technological and security needs including customer experience (CX) and employee experience (EX), change management, edge infrastructure, identity management, and internet of things (IoT). The addition of TEC360 to Auth0’s [Partner Program](https://auth0.com/partners) and Auth0’s growth in the region indicates the growing demand and importance of identity management in securing the new and complex digital world as businesses have to meet the ever-growing expectations for security, privacy, and convenience.

Globally, the pandemic has [accelerated digital road maps across industries](https://auth0.com/blog/how-brick-and-mortar-approaches-improve-digital-experiences/), and businesses now have to quickly respond to changes in digital expectations and buying patterns — and in LATAM the technology penetration has been rapidly growing at an average rate of 65% year-over-year since 2003 ([2020 Latin America Digital Transformation Report)](https://www.atlantico.vc/latin-america-digital-transformation-report), with Mexico as the second-highest country in LATAM, following Brazil. As the number of online identities continue to increase, so do the number of online threats — a modern identity platform offers the right balance of convenience, privacy, and security to protect and retain customers.

“At TEC360, our commitment is to provide enterprise customers with the best cloud solutions that give their organization and customers more choice and flexibility to accelerate growth and innovation,” said Peter Wiegandt, CEO of TEC360. “Identity management is a critical part of these projects, and by joining forces with Auth0 we will give our customers in Mexico and throughout LATAM the extensible building blocks to solve for an identity use case without having to compromise between convenience, privacy, or security.”

“More than ever, a modern identity solution can help accelerate digital transformation, remove security risks, and positively impact the business through improved user experiences,” said Ghazi Masood, SVP and General Manager, Americas at Auth0. “We are proud to join forces with TEC360 to help customers in the region customize identity for their exact use case, enabling them to free up time and resources previously spent on the complexities of identity management to focus more on their core value proposition.”

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Grupo Muchnik PR for Auth0 <br />
[auth0@muchnik.co](mailto:auth0@muchnik.co) <br />

### Investor Contact
Investor Relations <br />
[investor@okta.com](mailto:investor@okta.com) <br />

Auth0 Expands Reach to Mexico with TEC360 Partnership

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Global identity management provider supports the launch of Ivy League MBA interactive learning platform

**BELLEVUE, Wash. – Oct. 28, 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced it has been selected as the identity and authentication provider for [Wharton Interactive](https://interactive.wharton.upenn.edu/), an interactive learning platform that draws on games, simulations, and research to make Ivy League business education more accessible to all. To enable a seamless, end-to-end experience for learners and educators, Auth0’s platform will provide a [Single Sign-on](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) (SSO) solution for learners and educators throughout their journey.

Wharton Interactive — founded by Sarah Toms, executive director, and Professor Ethan Mollick at the Wharton School, The University of Pennsylvania — has developed different modes of delivering education on its Alternate Reality Courseware (ARC) platform. ARCs knit together leading subject matter expertise and an immersive games-based experience where users gain mastery through practice and receive personal feedback about their performance every step of the way. By increasing inclusive access to business education, this unique higher ed initiative strives to better the socio-economic status of individuals and lift economies through job creation.

To aid in Wharton Interactive’s marketplace launch, the team wanted to create one, seamless user experience across the entire platform, from the user’s account creation and management to the interactive simulations and classes, and selected Auth0 to help. By implementing SSO, students and educators can enter their login credentials once and automatically gain access to multiple applications. Through the implementation of Auth0’s SSO solution, Wharton Interactive’s platform benefits from increased security and privacy while improving the end-to-end experience for users.

“Auth0 plays an integral role in making Wharton Interactive’s mission to transform education a reality by eliminating the hurdles associated with having to login to multiple systems along the customer journey,” said Sarah Toms, co-founder and Executive Director for Wharton Interactive. “We were searching for a top-notch identity provider with proven expertise in SSO, and are so pleased that we have partnered with Auth0. From vendor selection to launch, it took only a few months to build and deliver a comprehensive solution that was ready for market.”

“Wharton Interactive is democratizing higher education and transforming the eLearning space with its cutting-edge approaches, and identity is a key enabler in supporting this mission — strong user experience, security, and privacy practices all start at login,” said Ghazi Masood, General Manager and SVP of Americas at Auth0. “We’re honored to support Wharton Interactive’s identity needs and help them seamlessly scale as they make education more attainable and secure for educators and learners around the world.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter Communications for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

### Investor Contact:
Investor Relations <br />
[investor@okta.com](mailto:investor@okta.com)

Wharton Interactive Selects Auth0 to Help Securely Democratize and Transform Education

Flutter Authentication and Authorization with Auth0, Part 4: Roles and Permissions

Flutter Authentication and Authorization with Auth0, Part 3: Adding Real-Time Chat to the App

john-brennan

John is an R&D Content Engineer at Auth0. He has nearly a decade’s experience in full-stack software development in a variety of environments, languages, and frameworks. He relishes the challenge of learning hard-to-grasp technical concepts and helping others understand them in a clear, concise manner. His current technical interests are in API design and scalability, Ruby on Rails, accessibility, single-page app architecture, and the ever-changing JavaScript ecosystem. When he's not working, John is usually cooking, doing creative writing, running, or wrangling a toddler.

R&D Content Engineer

John Brennan

How to use HashiCorp Terraform and the Auth0 Provider to maintain your critical infrastructure, including your Auth0 configuration, in code.

Use HashiCorp Terraform to Manage Your Auth0 Configuration

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Enhanced identity management for builders and providers of B2B SaaS applications enables faster implementation and best-in-class security, branding, and administration

**BELLEVUE, Wash. – April 26, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Organizations](https://auth0.com/organizations), a purpose-built feature enabling providers of B2B SaaS applications to seamlessly manage their business customers—a use case Auth0 defines as Business Customer Identity. Organizations is Auth0’s enhanced way for enterprise app teams to manage customers and partners in any multi-tenant, B2B, or SaaS application. With Organizations, B2B implementations are less complex, enabling faster speed-to-market and a better overall experience for business customers and partners. 

Business Customer Identity remains largely unaddressed by today’s Workforce Identity and Customer Identity Access Management (CIAM) solutions, forcing those who build and deliver B2B SaaS applications to cobble together features to address their unique use case. This requires significant customized configuration leading to high ongoing maintenance and configuration costs, slower time to market, and more difficult use case expansion and new app development.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5AGLt3QorElIYSuC43J2TE/c3db1cfffa3649353fab74e01dcdd511/approved-asset-three.jpg)

Business apps are not just used by individuals but by teams and entire companies, all of which need easy and secure onboarding, flexible membership provisioning, access control, and SSO setup. Convenience for B2B users is also increasingly in demand, prompting enterprises to provide similar seamless experiences to business partners as they do for consumers. Auth0 Organizations solves all of these issues and more, offering customizable identity management of any business customer or partner.   

Key benefits of Auth0 Organizations include: 

* **Simple Business Customer Onboarding:** Auth0’s APIs and SDKs can easily model entire business organizations, and rapidly-implemented admin dashboards manage SSO, Role-Based Access Control, and flexible user management workflows.
* **Custom-Branded Federations:** The ability to customize the login experience with branded login and registration flows ensures that business customers feel at home. 
* **Faster, Easier Deployment:** Less complex implementations shorten time to market, and integrations are accelerated as new products are built or acquired. 
* **Identity Engineering & Maintenance Costs Reduction:** Engineering resources can shift to work on core product innovation instead of focusing on complex identity issues.

“We were initially looking for a platform solely to handle SSO for our enterprise customers. Organizations is a great fit and offers enough flexibility to replace authentication for our 300+ non-enterprise customers, too,” said Steven Easton, Lead Engineer at Amiqus. “We’ve been really impressed with how powerful Auth0 is and yet have barely scratched the surface. We are excited to roll out Organizations as an improvement to our business customers’ experience and value how easy Auth0 makes it to do so.”

“We see Business Customer Identity as a standalone use case, one that our customers have increasingly been confronted with and had trouble fully addressing—until now,” said Shiv Ramji, Chief Product Officer at Auth0. “B2B identity management represents a sizable portion of our business and is consistently growing, demonstrating the need that Business Customer Identity addresses. We are thrilled to launch Auth0 Organizations as our next-generation offering for easy onboarding, authentication, and administration of business customers.”

More information can be found at [Auth0 Organizations](https://auth0.com/organizations).

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Launches Organizations, Transforming the Way Enterprises Manage Business Customer Identity

Global identity management provider recognized for commitment to government, education, and nonprofit customer success

**BELLEVUE, Wash. – April 14, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has joined the [Amazon Web Services (AWS) Public Sector Partner (PSP) Program](https://aws.amazon.com/partners/public-sector/). The AWS PSP Program recognizes AWS Partner Network (APN) Partners with solutions and experience in delivering government, education, and nonprofit customer missions around the world.

Auth0 and AWS are teaming up to help serve public sector customers in solving their unique security, privacy, and user experience challenges to meet mandates, reduce costs, drive efficiencies, and accelerate innovation. As an AWS Public Sector Partner, Auth0 now offers its extensible authentication and authorization solutions to the public sector community on the AWS Marketplace. To be selected for the program, Auth0 had to meet pre-defined criteria, including deep expertise and commitment to delivering government, education, and nonprofit services on a global basis. 

“We are honored to join the AWS PSP Program—this recognition reflects Auth0’s commitment to helping the global public sector community,” said Bill Lapcevic, VP of Business Development at Auth0. “As a Public Sector Partner, we are enabling public sector customers to accelerate their business growth on AWS, and are in a unique position to help these customers achieve their cloud security goals as they scale.”

In addition, Auth0 announced the appointment of Dean Scontras, Senior Director of Public Sector Sales, to lead the company’s federal, state, and local business and sales strategy.

“For the public sector, in particular, the onset of COVID-19 has accelerated the transition to digital citizen services, and heightened the need for organizations across all industries to secure their valued assets and data more firmly,” said Scontras. “I’m honored to join the Auth0 team and aid the company’s continued efforts in helping government agencies at the local, state, and federal level as they move towards digital citizen services and the essential role identity will play in that move.” 

Auth0 is an AWS Advanced Technology Partner that is participating in [AWS Public Sector Summit Online](https://aws.amazon.com/events/summits/online/public-sector/?did=ep_card&trk=ep_card), taking place April 15, 2021. To learn more, visit: [https://info.auth0.com/auth0-at-aws-publicsectorsummit-2021.html](https://info.auth0.com/auth0-at-aws-publicsectorsummit-2021.html)

Auth0 achieved the [AWS Security Competency](https://auth0.com/blog/auth0-achieves-aws-security-competency/) status in 2020 and was one of the first AWS Partners to give AWS customers seamless access to [professional services in AWS Marketplace](https://auth0.com/blog/auth0-supports-the-launch-of-professional-services-in-aws-marketplace/). For more information, visit [Auth0’s AWS Partner page](https://partners.amazonaws.com/partners/001E000000YKGRTIA5/Auth0). 

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Joins the Amazon Web Services Public Sector Partner Program

Global identity management provider recognized as a top IT cloud management product



**BELLEVUE, Wash. – Feb. 17, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it was recognized on G2’s Best Software for 2021 list. The list ranks software companies and products based on G2’s thorough vetting process of verified user reviews of groups of similar products. Auth0 ranked #13 on the ‘[IT Cloud Management Products](https://www.g2.com/best-software-companies/top-it-management)’ list, based on its high levels of G2 user ratings for customer satisfaction and likeliness to recommend.  

G2 created the list based on data from over one million authentic, verified customer reviews. Winners were determined based on reviews left at G2.com between Jan. 1, 2020, and Dec. 31, 2020. All scores were calculated using G2’s algorithms, including for Satisfaction and Market Presence, explained in detail [here](https://www.g2crowd.com/static/g2_grid_scores). 

“Identity is essential and is a long-term business enabler&mdash;we are proud to help our customers around the globe meet their identity management and security goals by providing a trusted, extensible way to handle identity,” said Holly Files, SVP of Customer Success at Auth0. “We are grateful for our customers’ feedback and G2’s recognition of Auth0, and are honored to be recognized on the list along with companies like Amazon, Hashicorp Terraform, and IBM.”

“This isn’t a subjective list based on a few peoples’ opinions,” explains G2 CEO Godard Abel. “With the highest traffic and engagement, largest selection of products and services, and highest quality data, G2 analyzes more than four million data points to determine which products and companies make the list.”

Auth0 is a G2 Leader ranking in five categories: [Customer Identity and Access Management (CIAM)](https://www.g2.com/categories/customer-identity-and-access-management-ciam), [Identity Access Management (IAM)](https://www.g2.com/categories/identity-and-access-management-iam), [Single Sign On (SSO)](https://www.g2.com/categories/single-sign-on-sso), [User Provisioning and Governance](https://www.g2.com/categories/user-provisioning-and-governance-tools), and [Multi-Factor Authentication (MFA)](https://www.g2.com/categories/multi-factor-authentication-mfa). Learn more about what real users have to say (or leave your review of Auth0) on G2’s [Auth0](https://www.g2.com/products/auth0/reviews) review page.

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />


Auth0 Ranked on G2’s 2021 Best Software Companies List

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Learn how ISO 27018 controls help cloud service providers reduce security risks for personal data.



ISO 27018 is the first international standard created specifically for [data privacy](https://auth0.com/blog/data-privacy-101/) in cloud computing. Its main objective, according to the [International Organization for Standardization (ISO)](https://www.iso.org/standard/76559.html), is to establish “commonly accepted control objectives, controls, and guidelines for implementing measures to protect Personally Identifiable Information (PII).”

ISO 27018 is part of the ISO 27000 family of standards, which define best practices for information security management. ISO 27018 adds new guidelines, enhancements, and security controls to the ISO/IEC 27001 and ISO/IEC 27002 standards, which help cloud service providers better manage the data security risks unique to PII in cloud computing.

Although ISO 27018 is not a law, there are a number of benefits to following its guidelines and earning certification (more on this below). And since [the standard isn’t free](https://www.iso.org/standard/76559.html) to the public, we’ve combed through it to help you make intelligent decisions on compliance and certification.

Below are the most important things you need to know about ISO 27018 and why it’s a good idea to follow.

## Version “2019” vs. “2014” - What’s New?

ISO 27018 was first created in 2014 (ISO/IEC 27018:2014) and was last revised in 2019 (ISO/IEC 27018:2019). The differences between the two versions are minor and do not change the best practices for protecting PII in cloud computing and public cloud applications in any major way.

As ISO states in Section 2 of the 2019 version, “This second edition cancels and replaces the first edition (ISO/IEC 27018:2014).” It goes on to explain that the revisions are primarily to correct an editorial mistake in Annex A.

However, **one noteworthy revision to point out**, from a certification standpoint, is that ISO 27018 is no longer referred to as a “standard” within the document itself. Instead, the latest revision replaces all mentions of “standard” with the word “document.”

In plain English, that means **ISO 27018 is now considered a set of guidelines and controls that enhance ISO 27001** (the standard for building an information security management system or ISMS), rather than a standard for organizations to certify against.

Cloud service providers should instead certify against ISO 27001 using 27018 guidelines in the event that they process PII.

## Why ISO 27018 Compliance Is Beneficial

[A study by PWC](https://www.pwc.com/us/en/services/consulting/library/consumer-intelligence-series/cybersecurity-protect-me.html) found that “85% of consumers will not do business with a company if they have concerns about its security practices.” Simply put, ISO 27018 compliance is a competitive advantage for both cloud service providers and their customers:

* **For cloud service customers**: If you can show consumers that their data is protected by comprehensive PII protection standards (by working with cloud service providers that follow ISO 27018), they’ll be more likely to do business with you.
* **For cloud service providers**: If you’re ISO 27018-compliant, it makes it easier to close deals with prospective customers because you can say, “We follow the most comprehensive data controls.”

Here are four additional ways ISO 27018 compliance benefits businesses.

### 1. Improved Global Operations

Since ISO 27018 is an extension of ISO 27001, it’s part of an internationally recognized standard. That means it’s easier for cloud service providers to provide assurances on their security practices if they’re doing business globally, as the standard is recognized in most countries.

_**Note**: Following ISO 27018 will streamline cloud privacy in many instances, given its global acceptance. However, it’s always important to consult a data privacy attorney skilled in the laws of the specific country you’re trying to do business in to ensure that you’re compliant._

### 2. Improved Security And Legal Protection

Earning the ISO 27001/27018 certification is an important part of establishing a baseline of security for any business that processes data in the cloud. Simply put, following these standards helps you reduce security risk since they are recognized as some of the comprehensive in cloud computing applications.

Implementing ISO 27018 controls and earning a certification also helps protect your business against charges of negligence or recklessness in the event that a breach was to occur.

Negligence charges can often incur more severe penalties ([as Equifax found out in 2019](https://www.theverge.com/2019/7/22/20703497/equifax-ftc-fine-settlement-2017-data-breach-compensation-fund)). But if a business is using a well-defined, risk-based approach to protect users’ personal data, it not only decreases the likelihood of a breach, but that also evidences a company’s focus on security.

The same goes for customers of cloud service providers. Working with ISO 27001/27018-certified cloud providers shows regulators you’re taking important steps to protect your users’ personal data.

### 3. Streamlined Sales Processes

Corporate security is a major friction point for a lot of IT sales deals. ISO 27018 helps reduce that friction because it simplifies the amount of information required for corporate security to sign off.

Instead of a long drawn out inquisition or questionnaire from prospective customers, an ISO 27001/27018 certified cloud service provider can simply have their customers review their Statement of Applicability (a list of in-scope security controls and implementation) to provide them the assurances they need to close the deal.

### 4. Better Security For A Postpandemic World

Cloud computing usage is rising at a significant rate ([spending is up 37% in 2020](https://www.pwc.com/us/en/industries/tmt/library/covid19-cloud-infrastructure.html), according to PwC) due to an [increase in remote work](https://news.gallup.com/poll/321800/covid-remote-work-update.aspx) as a result of COVID-19. This increase has also led to an increase in cyberattacks across the globe, according to [Interpol](https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-report-shows-alarming-rate-of-cyberattacks-during-COVID-19) and the [U.S. Chamber of Commerce](https://www.uschamber.com/series/above-the-fold/the-evolution-of-cybersecurity-threats-during-covid-19-and-what-you-can-do).

However, while many workers have already returned to the office, as of the end of 2020, [a survey by PwC](https://www.pwc.com/us/en/library/covid-19/us-remote-work-survey.html) shows that remote work will likely stay commonplace even after the pandemic is over. As a result, cloud usage will likely remain high to accommodate remote workers, and ISO 27018 compliance will continue to remain beneficial after COVID-19 is long gone.

## ISO 27018 Controls and Compliance

If you’re serious about following the controls laid out in ISO 27018 or earning an ISO 27001 certification, we highly recommend you read both standards to familiarize yourself with all that is required of you. 

To get a better feel for what you need to prepare for, here is an overview of the controls laid out in ISO 27018 and the process for certification through ISO 27001.

### ISO 27018 Controls Overview

The requirements below are a guideline for cloud service providers on how to update their procedures, technology, infrastructure, etc., in order to follow the controls laid out in ISO 27018.

Some of these recommendations will likely feel familiar, as they show up in regulations like the [GDPR](https://auth0.com/blog/your-quick-gdpr-compliance-checklist/) (just one example of how the ISO 27018 guidelines can help you meet regulatory requirements in different countries):

1. **Always process customer data according to a customer’s wishes**. Basically, you’ll need to show that you’re only using PII the way(s) its owners have explicitly said you can. Meaning, if a user says you’re not allowed to use their information for marketing and advertising, you should have processes for ensuring that never happens.
2. **Help cloud customers provide their users access to their data when they request it**. Or, in plain English, if your customers’ customers want to access their data, you need to have the processes and technology set up to help them do that.
3. **Enable cloud customers to comply with their notification obligations in the event of a data breach**. If breached, cloud service providers should help provide their customers’ visibility into their own data.
4. **Share information with the minimum required parties**. Basically, keep data private unless you’re required to turn it over. This helps keep personal information safe.
5. **Tell your customers about any subprocessors in your contract with them**. This includes notifying your customers about any location(s) where that data is being processed.
6. **Ensure you have a policy for disposing of (or returning) data that is no longer in use**. For example, if a customer ends their service agreement with you, you must have a plan for what to do with their data.
7. **Have your operations regularly reviewed and audited by a third party**. Certification is required annually by a third party. But if you make significant changes to your processing procedures, you’ll also need a third party to review them.
8. **Ensure that every employee with access to your customers’ data is under NDA**. This adds accountability and legal protection in the event that one of your employees is responsible for sharing data when they’re not supposed to.
9. **Ensure that your staff has adequate training**. All of your employees who have access to your customers’ data should be trained to handle it in accordance with ISO 27018 guidelines.

### ISO 27001 Certification Process Overview

As mentioned above, ISO 27018 certification is part of the certification process for ISO 27001 for cloud service providers. Certification for ISO 27001 is required every three years and is determined by an ISO-accredited third party. It typically happens in two stages:

1. **Stage 1: An informal review of your information security management system (ISMS)**. The purpose of Stage 1 is to familiarize auditors with your organization. During this stage, auditors will check up on key documentation and procedures (to ensure they exist).
2. **Stage 2: A formal compliance audit**. In Stage 2, auditors will perform detailed tests of your ISMS against the requirements in ISO 27001 and 27018, looking for evidence that it meets the requirements laid out in the standard. If your ISMS passes this stage, you’ll achieve certification for the year.

After certification, you’ll be required to participate in annual surveillance audits to ensure ongoing compliance. If your ISMS is on the newer side, they could occur several times a year to ensure that everything is in order.

## Are ISO 27018 Controls Worth Implementing?

While the controls laid out in ISO 27018 are not legally required, it’s a really good idea to follow them if you’re a cloud service provider who processes PII&mdash; especially if you’re doing business internationally.

It’s true that the costs of certification through ISO 27001 can be prohibitive for some (certification costs vary from business, depending on the size of your business, the scope of your cloud utilization, etc.). But a data breach isn’t cheap either ([$3.86M](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/), on average).

And although certification won’t prevent a breach altogether, the controls ISO 27018 recommends certainly can improve your chances of avoiding one (you’ll also have better coverage in the event a breach does occur), even if you don’t pursue a certification.

Especially when you consider the impact a breach can have on your brand ([65%](https://www.centrify.com/media/4772757/ponemon_data_breach_impact_study_uk.pdf) to [80%](https://www.forbes.com/sites/forbestechcouncil/2017/12/08/mind-the-trust-gap-how-companies-can-retain-customers-after-a-security-breach/#40b4b2806c95) of consumers lose trust in a company that’s been breached)!

<include src="asides/AboutAuth0" />


What Is ISO 27018:2019? Everything Executives Need to Know

Leading laboratory testing provider seamlessly handles 25x volume increase in patient portal users during COVID-19 with Auth0



**BELLEVUE, Wash. – Dec. 10, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it is providing [BioReference Laboratories, Inc.](https://www.bioreference.com/), an OPKO Health company and a leading provider of laboratory testing services in the U.S., with end-to-end authentication for its patient portal, giving patients HIPAA compliant and secure, direct access to their lab results and medical data. This was essential as COVID-19 hit and BioReference faced a rise in new patient portal users&mdash;including a 25x increase in volume overnight&mdash;who needed a secure and easy way to monitor their test results.

BioReference provides comprehensive diagnostic solutions to healthcare providers, clinics, hospitals, employers, government units, correctional institutions, medical groups, and more. The laboratory’s vast test menu is utilized in the detection, diagnosis, evaluation, monitoring, and treatment of disease, including COVID-19. In recent months, BioReference has made significant investments in its B2B and B2C offerings, including Customer Digital Solutions, Direct-to-Consumer Solutions, Telehealth, and Patient Empowerment. 

“COVID-19 has caused a seven to ten-year acceleration in consumer and digital trends,” said Richard Schwabacher, SVP for Digital Health and Chief Digital Officer at BioReference Laboratories. “Securing, transmitting, and authorizing patient access to health information digitally is now critical to the practice of medicine and core to what is needed from a modern digital health solution.”

Identity and access management (IAM) was a key component in BioReference’s transition to providing a more patient-centric model. The company leveraged Auth0 as the IAM in its new patient portal so that patients can securely see results and pay bills, giving patients direct access to their healthcare information. Now, patients no longer have to depend upon their healthcare provider to act as an intermediary to access this information.  

“Auth0 helps address concerns about security and user access, especially during times like the present when COVID-19 is causing a significant increase in patient demand,” said Vinny Pacione, VP of Consumer Technology and Digital Solutions at BioReference Laboratories. “Enabling delivery of this data to individuals in a self-service way using scalable, automated digital platforms was a key problem to solve. The most fundamental piece of the solution is securing the data and ensuring that only the individuals who have appropriate authorization can access it.”

“Identity management is a critical component of any digital transformation initiative, and COVID-19 has forced many companies into transition,” said Ghazi Masood, SVP of Americas for Auth0. “BioReference aspires to transform telehealth and put patients at the center of the future of medicine. We are proud to aid them in their journey and help them to deliver a secure, seamless experience for their patients.”

More details on BioReference’s implementation of Auth0 can be found [here](https://auth0.com/case-studies/bioreference/).

## About BioReference Laboratories, Inc.

BioReference provides comprehensive testing to physicians, clinics, hospitals, employers, government units, correctional institutions, and medical groups. BioReference developed and offers test services that yield high quality and accurate results, including a molecular test for helping with COVID-19 diagnosis and a serology test to help indicate possible COVID-19 exposure. The company is in network with the five largest health plans in the United States, operates a network of 11 laboratory locations, and is backed by a medical staff of more than 120 M.D., Ph.D., and other professional level clinicians and scientists. With a leading position in the areas of genetics, women’s health, maternal fetal medicine, oncology, and urology, BioReference and its specialty laboratories, GenPath and GeneDx, are advancing the course of modern medicine. For more information, visit [www.bioreference.com](https://www.bioreference.com/).

<include src="asides/AboutAuth0" />

### Media Contacts: 
Auth0 Global Communications <br />
[press@auth0.com](mailto:press@auth0.com) <br />
 
Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />

BioReference Laboratories Communications <br />
[media@bioreference.com](mailto:media@bioreference.com)


Auth0 and BioReference Laboratories Answer Patient Demand for Secure, Direct Access to Test Results

Global identity management provider one of the first AWS Partners to give AWS customers seamless access to professional services in AWS Marketplace



**BELLEVUE, Wash. – December 3, 2020** – The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it is participating in the launch of Professional Services in AWS Marketplace. Amazon Web Services (AWS) customers can now find and purchase professional services from Auth0 in AWS Marketplace, a curated digital catalog of software, data, and services that makes it easy to find, test, buy, and deploy software and data products that run on AWS. As a participant in the launch, Auth0 is one of the first independent software vendors to quote and contract services in AWS Marketplace to help customers implement, support, and manage their software on AWS. [Click here](https://aws.amazon.com/marketplace/seller-profile?id=0079abaf-bc2f-481c-9543-d2bfedb81003) for more information. 

As organizations migrate to the cloud, they want to use their preferred software solutions on AWS. AWS customers often utilize professional services from Auth0 to help implement the Auth0 platform and enable interoperability with their applications. Until now, AWS customers had to find and contract professional services outside of AWS Marketplace and could not acquire an identity platform solution and associated professional services in a single procurement experience. With professional services from Auth0 available in AWS Marketplace, customers have a simplified way to purchase and pay for both their subscription to the Auth0 platform and related professional services in a centralized place. 

“Auth0 is proud to offer professional services in AWS Marketplace and provide AWS customers with additional support they may need for any identity implementation,” said Bill Lapcevic, VP of Business Development at Auth0. “We are excited to be one of the first independent software vendors to offer professional services as part of this launch and look forward to providing an even more comprehensive identity offering for AWS customers.”

Auth0 is an AWS Advanced Technology Partner that is participating in AWS re:Invent 2020, taking place November 30 - December 18, 2020. To learn more, visit: [https://info.auth0.com/auth0-at-aws.html](https://info.auth0.com/auth0-at-aws.html). 

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />


Auth0 Supports the Launch of Professional Services in AWS Marketplace

Global identity management provider recognized as one of the fastest-growing companies in North America for second consecutive year



**BELLEVUE, Wash. – November 18, 2020 –** [Auth0](http://www.auth0.com/), the identity platform for application teams, today announced its inclusion on [Deloitte's Technology Fast 500™](https://www2.deloitte.com/us/en/pages/technology-media-and-telecommunications/topics/north-america-technology-fast-500.html) for the second year in a row. The list ranks the 500 fastest growing technology, media, telecommunications, life sciences, and energy tech companies in North America. 

Auth0's inclusion is representative of the organization's remarkable year-over-year growth since its inception in 2013, and a 70% increase in overall revenue and customer acquisition in 2019 along with continued success through 2020. Auth0 announced a [$120 million round of Series F funding](https://auth0.com/blog/auth0-helping-navigate-through-times-of-transformation/) in July that brought the company's valuation to $1.92 billion and total capital raised to more than $330 million. 

"Being included on the Deloitte Technology Fast 500 for the second year in a row is a great testament to Auth0's growth, despite the challenges that 2020 posed," said Eugenio Pace, CEO, and co-founder of Auth0. "Our placement represents the commitment and accomplishments of our entire team and the support of our loyal customers, partners, and investors. We will continue this dedication and deliver innovative solutions for the persistent problem that our technology is solving."

<include src="asides/AboutAuth0" />

## About Deloitte's 2020 Technology Fast 500™

Now in its 26th year, Deloitte's Technology Fast 500 provides a ranking of the fastest-growing technology, media, telecommunications, life sciences, and energy tech companies &mdash; both public and private &mdash; in North America. Technology Fast 500 award winners are selected based on percentage fiscal year revenue growth from 2016 to 2019.

In order to be eligible for Technology Fast 500 recognition, companies must own proprietary intellectual property or technology that is sold to customers in products that contribute to a majority of the company's operating revenues. Companies must have base-year operating revenues of at least $US50,000 and current-year operating revenues of at least $US5 million. Additionally, companies must be in business for a minimum of four years and be headquartered within North America.

## About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee ("DTTL"), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as "Deloitte Global") does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the "Deloitte" name in the United States, and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see [www.deloitte.com/about](http://www.deloitte.com/about) to learn more about our global network of member firms.

### Media Contacts

Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />
 
Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />


Auth0 Ranked on Deloitte's 2020 Technology Fast 500™ 

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Leverage Auth0’s extensibility to send SMS MFA messages using the provider that best aligns with your business



Auth0 supports different options for enabling MFA to protect user account access: push notifications, authenticator apps like Google Authenticator, and one-time codes delivered through email, SMS, or third party products such as Duo.

Until now, Auth0 has integrated with Twilio as an SMS provider, which has been a great solution for our customers. However, some customers require additional flexibility when selecting SMS providers. For example, larger organizations may use a single provider for multiple purposes and want to leverage that provider for SMS MFA to consolidate payments and enjoy volume discounts.

Organizations have a number of SMS providers they can choose from depending on their business needs. There are a number of factors to consider when selecting an SMS provider: 

* **Cost:** Some SMS providers may offer more favorable pricing and pricing models than others based on the region or country to which you want to send messages.
* **Integration with your existing software infrastructure:** You may already have a provider that helps you consolidate a single view of all the communications with your users, and you want to keep using it.
* **Compliance:** You might require certain certifications from your SMS provider, which not all vendors can provide.
* **Quality of service:** Some SMS providers may have better deliverability rates than others based on the region or country of the receiver.

Selecting the right provider can yield considerable cost savings to your business and deliver a better user experience to your customers. With this in mind, we are pleased to announce that **you can now use _ANY_ provider** for delivering SMS MFA messages. Auth0 is **the first cloud identity product** that gives you that option.

## Extending Auth0

Auth0 has a powerful and scalable extensibility platform where you can write your own code that can be executed when needed. One of the extensibility points is Auth0 Hooks, which are serverless functions that Auth0 calls when a certain event happens.

You can write code to send SMS messages in our new "Send Phone Message Hook." 

To achieve this, you need to follow three simple steps:

* Create a new "Send Phone Message" [Hook from the Hooks Dashboard’s section](https://manage.auth0.com/dashboard/#/hooks) and give it a name. In this case, you'll be creating one to deliver messages using [AWS’s Simple Notification Service](http://aws.com/sns).

![Simple Notification Service 1](https://images.ctfassets.net/23aumh6u8s0i/4pGiT6S8Awe5kDzwsih44N/093c530a25c70d7945df5b130dc7b86a/1_create-new-hook)

![Simple Notification Service 2](https://images.ctfassets.net/23aumh6u8s0i/5k4AYgPss1iRbZmBFUaSU6/da0b0a2d2bca64872926b17be0870cd9/2_new-hook)

* Write the code to send a text message or use a [full example of how to send text messages with Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns).

![Amazon SNS](https://images.ctfassets.net/23aumh6u8s0i/2pqPsBOiS1bOBaOMX9gtzh/88c2847a5495b6620fa4b719bff6efa5/3_sns-hook)

* Configure the SMS MFA Factor to deliver messages using the Phone Message hook:

![SMS MFA](https://images.ctfassets.net/23aumh6u8s0i/2QTRc0KOhiqTxPWbxrTBWw/8fcfda5305900bf23e1280314164b9af/4_sms-provider)

## Using Your Vendor of Choice

We included documentation on how to implement SMS Delivery with [Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns), [Twilio](https://auth0.com/docs/mfa/send-phone-message-hook-twilio), [Infobip](https://auth0.com/docs/mfa/send-phone-message-hook-infobip), [TeleSign](https://auth0.com/docs/mfa/send-phone-message-hook-telesign), [Vonage](https://auth0.com/docs/mfa/send-phone-message-hook-vonage), [Mitto](https://auth0.com/docs/mfa/send-phone-message-hook-mitto), and [Esendex](https://auth0.com/docs/mfa/send-phone-message-hook-esendex). Just copy and paste the examples in your Hook code and start sending messages using your product of choice.

## Enhance Security With MFA
Auth0 provides the most usable and friction-free multi-factor authentication experience in the market. 

You get a state-of-the-art end-user experience for enrolling and authenticating with multiple factors, like push notifications and one-time password (OTP) apps, right out-of-the-box.

Just enable multi-factor authentication in the Auth0 Dashboard and immediately improve the security of your applications and users!

<include src="asides/AboutAuth0" />


Enable SMS MFA Using Any Provider

Leading professional services provider to integrate Auth0 for digital transformation initiatives



**BELLEVUE, Wash. – February 26, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Cognizant](https://www.cognizant.com/) (Nasdaq: CTSH) has joined its [Partner Program](https://auth0.com/partners) and will use Auth0 as one of its main authentication providers for any of its customers’ identity management needs. Ranked 193 on the Fortune 500 list with nearly 300,000 employees, Cognizant is an integral partner in transforming global enterprises’ business, operating, and technology models for the digital era.  

“Cognizant’s broad portfolio of consulting, professional, and managed security services are designed to help our clients around the globe to meet their security challenges,” said Ryan Parthasarathy, Vice President of Cognizant Security. “Given the complexity of identity management, we’re proud to partner with a global expert and game-changer in the CIAM space to enhance our security offerings and deliver only the best for our customers.”

Known for its highly-scalable platform, Auth0 was recently ranked as a [Leader for CIAM](https://auth0.com/blog/auth0-named-a-leader-in-the-g2-winter-2020/) on G2, the world’s leading business solutions review website. With high-velocity growth and more than 9,000 customers worldwide, Auth0 is answering the demand for identity management with a simple, extensible, and powerful solution for any application, for any audience.

“We’re thrilled to partner with Cognizant, an experienced leader in complex identity projects, and combine our teams’ expertise with our extensible, flexible, and trusted platform to aid Cognizant customers in a successful and secure digital transformation journey,” said Bill Lapcevic, VP of business development of Auth0. “Identity management is a critical and complex step in any transformation process, and a strong CIAM system will help customers modernize their business in a quicker and more organized fashion to address identity and security needs.”

Learn more about the [Auth0 Partner Program here](https://auth0.com/partners) along with the recent [growth of Auth0’s global partner network](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/), now serving more than 60 partners worldwide.

For more information about Cognizant Security, please visit [www.cognizant.com/security](https://www.cognizant.com/security).

<include src="asides/AboutAuth0" />

### Media Contacts
Kaycie East<br>
Auth0 Global Communications<br>
[press@auth0.com](mailto:press@auth0.com)<br>
 
Ryan Schin<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)<br>


Auth0 Expands Global Partner Network with Cognizant

725ee191354be8a85ea104735c7f9264

Software Engineer, Open Source Enthusiast, Tactical & Stealth Gamer, Sport Shooter, Motor Biker, interested in InfoSec, AppSec, Linux, Cyberpunk.

Enterprise Solutions Engineer

Mathias Conradt

Learn how to add an ID4me-compliant identity provider option to an application using Auth0



## Purpose

The purpose of this sample project is to demonstrate how you can use [Auth0](https://auth0.com/) to add an **ID4me-compliant** identity provider as an option to your end-users to sign up and log in to your web application.

## About ID4me

[ID4me](https://id4me.org) is an **open, global, federated standard** to manage online identities. It allows the user to establish their identity using **their own domain name** and then use that identity to log in and sign up at websites that support ID4me.

ID4me provides full data sharing control. ID4me users are not only free to choose their identity provider, they can **change their provider at any time**. This is also what differentiates ID4me from other commonly known social identity providers in the field.

The user can also use single-sign-on across different services with just one ID, which means they don't have to remember multiple passwords for different websites.

The initiative’s mission is to provide users with open and internationally available identity services that adhere to **security and data protection standards**, that foster** user choice**, and that **avoid identity lock-ins**.

ID4me is an open group of internet service providers, software developers, and other entities that care about the future of the internet and want to defend its distributed and federated architecture when it comes to digital identities.

## About Auth0

[Auth0](https://auth0.com) is an Identity as a Platform (IDaaS) service provider.

With Auth0, you take perhaps the riskiest endeavor your engineering organization will face, managing and securing the identities of your customers and employees, and abstract away this complexity and risk with our identity platform.

Our standards-based **Identity-as-a-Service** platform is built for developers, by developers so that your engineering organization can focus on building the solutions that delight your customers and drive your revenue. Our customers find that what typically either takes months to deliver or simply cannot be delivered via internal or external solutions, takes them only days to deliver with Auth0 due to our extensive SDKs, intuitive API, extensible architecture, and our simple management dashboard.

This is why Auth0 is the leader in developer-focused identity management, with more than 7,000 customers trusting us with billions of transactions everyday.

## Prerequisites

If you don't already have an Auth0 account, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

We assume that you have an existing ID4me identity and have already chosen an identity authority (identity provider) and identity agent (claims/user information provider). If not, go to the [Identity Agent website](https://identityagent.de/register) and create one for free.

This example demonstrates the use of `id.test.denic.de` ([DENIC-ID](https://www.denic.de/en/service/denic-id/) test environment) as the user identity authority and `identityagent.de` as the identity agent, according to the ID4me specification.

## Terminology

Before we proceed, let's clarify some terminology up front.

**Relying party**

An online service that uses ID4me to validate user logins.

*In our example*: a Node.js web application, but brokered via Auth0. (So, technically, Auth0 is the Relying Party).

**Identity authority**

An online entity ensuring the correct authorization of the user at every login, by storing and verifying their authentication credentials, such as their password. It represents the “back-end” and trust source for the provision of the authorization service, but it generally does not deal directly with the user and does not store or supply the user’s personal information.

*In our example*: `id.test.denic.de`

**Identity agent**

An online entity providing the ID4me service to users. It represents the “front-end” for the provision of the authorization service, selling or supplying ID4me identifiers to users and creating them at an identity authority. It also stores the user’s personal information, communicating it to the relying parties when
the user consents, and can potentially provide the user with reports and statistics on the service.

*In our example*: `identityagent.de`

A typical ID4me authentication flow, and the parties involved, looks like this:

![ID4me authentication flow](https://images.ctfassets.net/23aumh6u8s0i/7AwYCBasmS2ZnZCwJUJKUT/47fad22d847d9dc30da9631dbd30296b/Screen_Shot_2019-09-23_at_11)

## Configuration

The flow of this authentication process is a bit different than with other custom social connection providers added to Auth0, which is grounded in the federative concept of ID4me. Because of this, our integration with Auth0 will also be a little different.

We assume that the reader is generally familiar with the concept of ID4me. If you need to brush up, you can find more details [on the ID4me website](https://id4me.org/login-partner-developer-zone).

ID4me makes use of the [*Distributed Claims* mechanism](https://openid.net/specs/openid-connect-core-1_0.html#AggregatedDistributedClaims).

The following diagram outlines the flow of the overall authentication process when integrated with Auth0:

![Auth0 id4me authentication flow](https://images.ctfassets.net/23aumh6u8s0i/K1yKqChVMFOvzOqmlUsIB/8be37ffb4960d49398f99c39cb0d9632/auth0-id4me-flow)

### 1. Create Application

Register an Auth0 client application by creating a new application within Auth0. Go to the `Applications` section in the Auth0 dashboard and click the `+ Create Application` button.

![Create Auth0 application](https://images.ctfassets.net/23aumh6u8s0i/39UxGEeZaezod3amV5dyrx/3b14c4891847bc62e7d5f5a645719b16/applications-create)

Give the application any name you'd like (such as `Auth0 ID4me Demo`) and choose `Regular Web Application` as the type.

![Auth0 application type](https://images.ctfassets.net/23aumh6u8s0i/3EINXBPwEwGlASnU68dcZV/78baf14f54307d7bf6ed8886153f3c68/Screen_Shot_2019-09-09_at_3)

Next, choose `Node.js` as the technology.

![Auth0 application technology](https://images.ctfassets.net/23aumh6u8s0i/6kFW6FMyKEqVPvHp7KOsHB/408e555b48092202cdf819cd28c9ebb3/Screen_Shot_2019-09-17_at_2)

### 2. Client Application Settings

Click the `Settings` tab of the client application.

In the application settings:

* Make sure `Application Type` is set to `Regular Web Application`.
* Set `Allowed Callback URLs` to `http://localhost:3000/callback`
* Set `Allowed Logout URLs` to `http://localhost:3000`

![Auth0 application settings](https://images.ctfassets.net/23aumh6u8s0i/3XfJdSQmO0MqWPZmGBKlsC/9a5c36474a130c429232777862872458/Screen_Shot_2019-09-09_at_3)

The Application Logo can be adjusted to your liking. It's not a mandatory field.

Take note of `client_id` and `client_secret`, you will need these later in the actual Node.js application.

### 3. Client Application Connections

Click the `Connections` tab of the client application.

Make sure that no connection is enabled here, as we'll purely rely on ID4me for this example. The `Username-Password-Authentication` connection might already be enabled, so make sure you disable it.

![Auth0 connections](https://images.ctfassets.net/23aumh6u8s0i/7BKCU2Dihn99fptcr6nWU5/1bc235c12b883ae8f3806bbbe4aa4fa5/Screen_Shot_2019-09-17_at_2)

### 4. Client Application Done

When you go back to the Applications section, the application should now be listed in the `Applications` overview:

![Auth0 applications overview](https://images.ctfassets.net/23aumh6u8s0i/66JdL8oaMMbow1GnxN9tlK/44876af1aa717467cf32649aa69c2368/Screen_Shot_2019-09-09_at_3)

### 5. Auth0 Management API Configuration

We need to grant our Node.js client application access to the Auth0 Management API.

For this, go to the `API` section of the `Dashboard`, select the `Auth0 Management API`, and select the `Machine to Machine Applications` tab in there.

Enable the `Authorized` switch for the `Auth0 ID4me Demo` application (so that it's green) and click the arrow on the right, which toggles the **Scopes** view.

Select the scopes `read:connections`, `update:connections`, `delete:connections`, and `create:connections` from the scope list.

Then hit the `Update` button at the bottom.

![Auth0 scopes](https://images.ctfassets.net/23aumh6u8s0i/1m7gdGEfOcrj1zEaUHz9Vt/1ffcd72280f235bc28d28a89e4887051/Screen_Shot_2019-09-17_at_10)

### 6. Cloning the Node.js Client Application from Github

Clone the GitHub repository for the sample Node.js client application:

```bash
git clone https://github.com/auth0-blog/auth0-id4me-sample.git
```

On your computer, switch to the folder where you checked out the project. 

```bash
cd auth0-id4me-sample-draft
```

Copy the `.env.sample` file to  `.env`:

```bash
cp .env.sample .env
```

Open the `.env` file in a text editor and adjust the values in it:

* `AUTH0_DOMAIN`: your Auth0 tenant domain (without `https://`)
* `AUTH0_CLIENT_ID`: the `client_id` from step 2 above
* `AUTH0_CLIENT_SECRET`: the `client_secret` from step 2 above

When finished, build and run the app:

```bash
npm install
npm start
```

Now open the browser and go to [`http://localhost:3000`](http://localhost:3000).

The client application is now up and running and you can test it with your **ID4me user**.

## ID4me Authentication

The user enters their `user id` in the client application, then presses the `Login with ID4me` button.

![ID4me login](https://images.ctfassets.net/23aumh6u8s0i/39z2raKukyj7zpmss7fuTW/7150a66bf86e3764ac8457ab1b847f54/Screen_Shot_2019-09-18_at_4)

The client application will redirect the user to Auth0, who in turn transparently federates the request further to the user's chosen ID Authority, in our example, Denic ID.

Here, the user ID will also be filled in so that the user is only asked to provide the password.

![ID4me login screen](https://images.ctfassets.net/23aumh6u8s0i/1KaKsR6xS9pz6y9be4dfcv/d397eef9434ebcbe48e83956a471614b/Screen_Shot_2019-09-09_at_2)

If it's the first time that the user uses the app and authenticates with ID4me, they will be asked what information they consent to share (between the ID4me authority and Auth0).

![ID4me consent](https://images.ctfassets.net/23aumh6u8s0i/4la8l7b9DbXyAooFrQaBJT/f1827e488d6dbed177e2cbf729cbdca6/Screen_Shot_2019-09-17_at_6)

Next, consent is also given to the Auth0 client application (consent to share between Auth0 an the Node.js client application).

![ID4me Auth0 consent](https://images.ctfassets.net/23aumh6u8s0i/4hHfKHKlWEUyrsdgvP8us9/09bc56486a0decf8557201792998717f/Screen_Shot_2019-09-17_at_6)

The browser redirects to the application, having received an ID token and information about the user:

![ID4me demo](https://images.ctfassets.net/23aumh6u8s0i/khJYUSUJKJZc5YLC70YbU/1d493b0734904fe9e0eddc96983cd7ca/Screen_Shot_2019-09-18_at_4)

## Auth0 Backend

### Auth0 Dashboard: Users

Let's look at the user list and into this specific user's detail after he authenticated:

![Auth0 user](https://images.ctfassets.net/23aumh6u8s0i/2UBg8JeAiFmU5HT6pNTQWk/78a98bba02bff0968623659c1e46c8c2/Screen_Shot_2019-09-17_at_2)

The user's primary identity provider is shown as `oauth2`.

![Auth0 ID4me user](https://images.ctfassets.net/23aumh6u8s0i/7Bmo6SUCGbZ0HUhni7AIyn/a500f07b12b0f361942c757513e9f81f/Screen_Shot_2019-09-17_at_2)

And the raw JSON of this user contains the ID4me identifier:

![ID4me identifier](https://images.ctfassets.net/23aumh6u8s0i/54fUG2ArZhgQFGe0GJL6H3/99e5188597fe4c1dc44a07fbfd8eef86/Screen_Shot_2019-09-17_at_2)

## ID4me Provider Backend

The following image shows the screenshots of both the User **Identity Authority** and **Identity Agent** (or User Information Provider).

The `General > Data` section at the User Information Provider (`identityagent.de` in our example):

![User identity provider](https://images.ctfassets.net/23aumh6u8s0i/5jh8GcauNjkCnavldSaqee/cd4d669896dfeb6e256bf436c41c2736/Screen_Shot_2019-08-29_at_3)

When the user clicks on the link `Identity authority dashboard`, they will get to the dashboard of `DENIC-ID`.

![identity authority dashboard](https://images.ctfassets.net/23aumh6u8s0i/79EdKJg7GlRb0M8j0PqgBs/018d9edf1c57a6104939cfc072cbc2e5/Screen_Shot_2019-08-29_at_3)

Once in the dashboard, you have various settings options to choose from, such as:

* Data Sharing
* Two-factor Authentication
* Password settings
* Account Status

![ID4me data sharing](https://images.ctfassets.net/23aumh6u8s0i/6XHwtozea2PKWp4lEZBcy6/e32ba380928177369080ec7010393bd3/Screen_Shot_2019-08-29_at_3)

![ID4me two factor auth](https://images.ctfassets.net/23aumh6u8s0i/2ROPaicMbXXNdNd2aYbk7G/698ca9aa00eb8e8adcc16ae3eccc90c5/Screen_Shot_2019-08-29_at_3)

![ID4me password settings](https://images.ctfassets.net/23aumh6u8s0i/42FXFoVsZYb1UsoP36jggb/5baff014fee2b3f24b6fcc40df531592/Screen_Shot_2019-08-29_at_3)

![ID4me account status](https://images.ctfassets.net/23aumh6u8s0i/2e5BV73fl6n0jHg2TErpry/43a8b96cae575e335912cd72f55682ef/Screen_Shot_2019-08-29_at_3)


Integrating ID4me with Auth0

Inclusion in Security category for creating opportunity for solutions providers.


BELLEVUE, Wash. — August 14, 2019 — [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today  announced today that [CRN](http://www.crn.com)®, a brand of [The Channel Company](http://www.thechannelco.com/), has named Auth0 to its 2019 Emerging Vendors list in the Security category. This annual list honors technology suppliers that prioritize technological innovation and shape the IT channel's future. It recognizes channel-focused companies across seven categories: Cloud, Data Center, Security, Big Data, Internet of Things (IoT), and Storage.

CRN's Emerging Vendors list honors technology suppliers driving innovation across the IT channel. It also provides a valuable resource for solution providers looking to incorporate cutting-edge technology into their portfolios.

[Auth0 Partner Program's](https://auth0.com/partners/) global growth is attributed to the unceasing demand on partners to provide comprehensive identity management solutions, and Auth0's ability to service those needs with its Universal Identity Platform. The integral role that identity plays in any digital transformation project is driving the need for secure, scalable solutions that are quick to implement and easy to maintain. 

"The partners we work with are instrumental in their customers' digital transformation journeys. Therefore, it is of utmost importance to us to make sure we provide them with the best identity platform, partner enablement, and support to achieve overall success," said Eric Snyder, senior director of partners at Auth0. "We are thankful to be acknowledged by CRN for our contribution to the channel."

Emerging Vendors are vetted and selected by CRN's editorial team. They provide state-of-the-art technology to help solution providers meet complex IT market demands, achieve bottom-line results, and deliver best-in-class offerings.

"CRN's 2019 Emerging Vendors list recognizes new, rapidly growing vendors that are making significant IT channel contributions," said Bob Skelley, CEO of The Channel Company. "It honors groundbreaking vendors that provide sophisticated technology to drive channel growth — and remain committed to ongoing innovation to shape the channel for years to come."

The Emerging Vendors list will be featured in the August 2019 issue of CRN Magazine and online at [www.CRN.com/EmergingVendors](http://www.crn.com/EmergingVendors).

<include src="asides/AboutAuth0" />

## About The Channel Company 

The Channel Company is The Channel Catalyst. Backed by more than 30 years of IT channel experience, we drive innovation and growth across the technology landscape. The IT channel is our sole focus and passion, and we deliver maximum value to technology suppliers, solution providers, and IT professionals every day. To learn more, please visit [www.thechannelco.com](http://www.thechannelco.com). 

**Follow The Channel Company:**  [Twitter](https://twitter.com/TheChannelCo), [LinkedIn](http://www.linkedin.com/company/the-channel-company) and [Facebook](https://www.facebook.com/TheChannelCompany?fref=ts)\
Copyright ©2019 The Channel Company, LLC. The Channel Company logo is a registered trademark of The Channel Company, LLC. All rights reserved.

### Media Contacts

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[press@auth0.com](mailto:press@auth0.com)

Meghan Gardner<br>
Matter for Auth0<br>
[mgardner@matternow.com](mailto:mgardner@matternow.com)<br>

### The Channel Company Contact	

Jennifer Hogan<br>
The Channel Company<br>
jhogan@thechannelcompany.com


Auth0 Recognized on CRN’s 2019 Emerging Vendors List

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

This release will make it simple to federate authentication to identity providers that support OIDC.



**TL; DR**: OpenID Connect (OIDC) support has been released as a beta Enterprise Connection in Auth0. This release will make it simple to federate authentication to identity providers that support OIDC.

<include src="TweetQuote" quoteText="#OIDC support has been released as a beta Enterprise Connection in Auth0!"/>

## What is OpenID Connect?

OIDC is an authentication protocol, based on the OAuth 2.0 family of specifications. While OAuth 2.0 is focused on resource access and sharing, OIDC is focused on user authentication.

For example, if you sign into an application using your Google account via OIDC, Google will authenticate you and return identity information about you and the authentication performed to the application. OIDC is designed to be easy to use for federation and most modern enterprise identity providers support it, including Microsoft, Google, and Salesforce. Learn more about OpenID in this [free OIDC Handbook - eBook.](https://auth0.com/resources/ebooks/the-openid-connect-handbook?ref=blog)

## What Are We Releasing?

We released an OIDC Enterprise Connection as a beta feature for all customers with an Auth0 Developer Pro or Enterprise license. This connection will allow you to easily federate authentication to any OIDC-compliant identity providers. More specifically, any identity provider that implements [OpenID Connect Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html) and supports the `id_token` response type and `form_post` response mode.

Configuration is simple. Here is an example:

<script src="https://fast.wistia.com/embed/medias/5y6uj9or72.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:69.06% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_5y6uj9or72 videoFoam=true" style="height:100%;position:relative;width:100%"><div class="wistia_swatch" style="height:100%;left:0;opacity:0;overflow:hidden;position:absolute;top:0;transition:opacity 200ms;width:100%;"><img src="https://images.ctfassets.net/23aumh6u8s0i/2QedtR0E2gqslLKRIYJb6Z/ccaf8e20d913ba60162e11c019b7a526/swatch" style="filter:blur(5px);height:100%;object-fit:contain;width:100%;" alt="" aria-hidden="true" onload="this.parentNode.style.opacity=1;" /></div></div></div></div>
<br/>
<br/>

Auth0 uses the issuer URL to find the OpenID Provider Configuration Document, which should be located in the <Issuer URL>/.well-known/openid-configuration endpoint. In the example above, Auth0 is connecting to Azure Active Directory (Azure AD) using the OIDC connection.
  
Once it is saved and enabled, a button will appear in the login page. When clicked, the button redirects to the Azure AD login page:

![An image showing OIDC Enterprise Connection in action](https://images.ctfassets.net/23aumh6u8s0i/4SODmHkFrB51P57FB0OfEm/d83911e2d9668bec124b8e2f90216b89/oidc-enterprise-connection-in-action)

Additional settings can be configured, including:

-   Connection Display name

-   Custom logo on the login page

-   Domains to be used for Home Realm Discovery 

-   Scopes

## How Do I Get Started?

Because it is an Enterprise Connection, the OIDC connection requires an Auth0 Developer Pro or Enterprise license. You can configure the connection in the Auth0 Management Dashboard by clicking Connections > Enterprise > OpenID Connect. [For more information, check out the docs](https://auth0.com/docs/connections/enterprise/oidc) and [the OpenID Connect Handbook.](https://auth0.com/resources/ebooks/the-openid-connect-handbook?ref=blog)

<include src="TweetQuote" quoteText="Easily federate authentication to any OIDC-compliant identity providers with Auth0's #OIDC Enterprise connection"/>

This is a beta feature. We welcome your feedback. [Please comment on this post in the Auth0 Community.](https://community.auth0.com/c/auth0-beta-programs/new-oidc-connection-beta)

<include src="asides/AboutAuth0" />


OpenID Connect Enterprise Connection Enters Beta

Healthcare AI and risk-prediction platform relies on Auth0 to connect healthcare providers and payers quickly and securely


**BELLEVUE, Wash. — June 10, 2019 —** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has been selected as the identity management platform for KenSci, a machine learning and artificial intelligence-powered risk prediction platform for healthcare. Recently having closed a successful round of funding, [KenSci](https://www.kensci.com/?utm_source=AIMed&utm_medium=PressRelease&utm_campaign=Press) is growing rapidly and will use Auth0’s authentication platform for thousands of healthcare users as it continues to scale.

KenSci is designed to help health systems across the globe improve the quality of care they provide at lower costs. Its machine learning-powered risk prediction platform helps healthcare providers and payers intervene early by identifying clinical, financial, and operational risk to save costs and lives. 

As its roster of healthcare clients continued to grow, KenSci realized the need for an outsourced identity management solution that was easily customizable. With the specialization required by their clients to provide access and authentication to the right parties, KenSci realized that managing the solution they had built in-house soon became a full-time job. After a thorough review of solutions, they selected Auth0 for its extensibility. 

“Auth0 really impressed us from the start, and the further we dug into it, the more it became clear that this was a natural extension of our platform,” said Ian Davies, Software Development Manager, KenSci. “Out-of-the-box, Auth0 covers about 80% of our clients’ needs, but it's really the last mile integration that requires a solution that we can modify for specific client requirements. We looked at several offerings, but Auth0 is the only identity management platform that offers the level of customization and flexibility we need.”

The sensitivity of healthcare data requires the utmost security when it comes to protecting user information. Auth0’s HIPAA-compliant platform enables authentication at any point of the customer’s journey, provides end-to-end protection, and allows for any custom-made requirements, as evidenced by KenSci.

“KenSci is bridging a major gap between healthcare providers and their clients, and making an impact in reducing their overall risk when it comes to healthcare decisions,” said Ghazi Masood, VP of Sales, Americas, for Auth0. “KenSci represents a large step in the modernization of healthcare and we are excited to be a part of its AI platform.”

<include src="asides/AboutAuth0" />

### Media Contacts

Kasia Hall<br/>
Matter for Auth0<br/>
[khall@matternow.com](mailto:khall@matternow.com)<br/>
971-246-7898


Auth0 Powers Authentication for KenSci to Enable Seamless Access to Quality of Care

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn about Sign In with Apple, the new identity provider announced at Apple WWDC 2019.

Sign In with Apple: Learn About the New Identity Provider

Discover how to set up and use German identity provider netID and integrate it using Custom Connections



## Purpose

The purpose of this sample project is to demonstrate how a web developer, using Auth0, can add the identity provider netID as an option for their end users to signup and login to their web applications.

![netID and Auth0 identity and authentication integration](https://images.ctfassets.net/23aumh6u8s0i/2rCEM5yhY3xoh4uYavsT0x/928c2056500c7ab57e2eb496577290e3/netid_splash-02)

[Photo by Daria Nepriakhina on Unsplash](https://unsplash.com/photos/_XR5rkprHQU)

## About netID

_**netID**_ is a European identity provider.

The European netID Foundation was founded in March 2018 by Mediengruppe RTL Deutschland, ProSiebenSat.1 and United Internet. Its aim is to establish the netID single sign-on as a European alternative to US providers. With netID, users can organize their consent to the use of internet services (opt-ins) transparently and in compliance with data protection regulations. To this end, the foundation has developed an open standard that enables users from all sectors to access all internet services of partners of the European netID Foundation with the same log-in. Right from the start which focuses the initial core market Germany, 38 million accounts covering roughly about 60% of the Germany online population are ready to be used.

- [https://netid.de/](https://netid.de/)
- [https://enid.foundation/](https://enid.foundation/)

Auth0 customers can add netID as a custom social connection alongside other social logins. netID is primarily an identity provider (IdP) focused on frictionless and secure login, rather than on bundling several services into one platform. This has security benefits, and gives consumers more visibility over how and where their data is shared. For these reasons, netID is an especially great option for companies in the DACH region (Germany, Austria, Switzerland) where consumers demand greater control of their personal information online.

## Creating a netID Service

### Prerequisites

We assume that you already have registered an Auth0 account and set up a tenant. If not, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

Also, we assume that you already have a client app setup in Auth0. If not, you can refer to the steps and screenshots [further below](#auth0-backend).

Furthermore, we assume that you have already registered a service provider account at netID. If not, [register a netID account here](https://developer.netid.de/register).

### netID configuration

To start, log in into the [netID Developer Portal](https://developerzone.netid.de/developerportal/index.html). Create a **Dienst** (service) for which you want to leverage the netID single sign-on. Select **Dienst** in the menu, click **Dienst hinzufügen** (Add service) and fill in the required details in the following screen. [Read the detailed documentation here](https://developerzone.netid.de/developerportal/dienste/dienst-anlegen.html#indexlink_help_developerportal_dienste) if you need further information.

A sample service could look like this, where the service domain (**Dienst Domain**) is the domain of your customer facing website. Also, links to data privacy information (**URL Datenrichtlinien**) and terms of usage (**URL AGB / Benutzungsbedingungen**) should be supplied:

![Creating a new netID service](https://images.ctfassets.net/23aumh6u8s0i/613X7O0cY0b684t0TopGDl/b2d30ff2f515fbb826ab06cb96437687/netid_create-service-00)

> Note: for testing purposes, you can actually enter any domain and URL values into this form, as they are not technically relevant in order to get the netID integration in Auth0 running

In the end, it should look similar to this:

![Reviewing the details in the netID developer](https://images.ctfassets.net/23aumh6u8s0i/2i1Ql13ESYhb8ZuNHHSTD8/f7625c39badb7588defa49a7ad65dfc7/netid_create-service-01)

Create a **Client** for this service by clicking on **Client hinzufügen** (Add client). [Detailed documation on how to do this](https://developerzone.netid.de/developerportal/clients/client-anlegen.html#indexlink_help_developerportal_clients) is available in the [netID Developer Portal](https://developerzone.netid.de/developerportal/index.html). It's critical to set the proper Auth0 callback URL for your tenant. The Auth0 Callback URL is `https://<tenant>.auth0.com/login/callback` where `<tenant>` needs to be replaced with your Auth0 tenant name.

Sample configuration:

![Sample configuration for a netID client](https://images.ctfassets.net/23aumh6u8s0i/4gDaCj5Acfwb2lrLi0PhVP/97d9dd32937d8247b16d0c80d5bd7abb/netid_create-client-sample)

> Note: the values here should be adjusted to your needs, especially "Callback URL", which needs to point to your Auth0 tenant and region

In the end, it should look similar to this:

![Creating a new netID client](https://images.ctfassets.net/23aumh6u8s0i/7J55Z734Wk0pArNqPALqPF/7129e9937cef20e4614fe972bc962406/netid_create-client-02-new)

Once the client is created it will initially run in a sandboxed mode, which means it can only be used with whitelisted netID-Accounts (email addresses).

In order to successfully run through the initial integration add a test user (email address) to the whitelist by selecting **Testnutzer hinzufügen** (Add Test-Account), outlined [on the developer portal](https://developerzone.netid.de/developerportal/testnutzer/testnutzer-anlegen.html). Up to 10 accounts can be whitelisted per sandboxed client.

Finally, find the **Client ID** and **netID Token - Sandbox** (later referred to as **client secret**) for the Auth0 configuration by expanding the client details, as shown in the following image:

![Viewing the client details of the netID app](https://images.ctfassets.net/23aumh6u8s0i/5yvbhrEWwtzyJFNnIQJlRk/5b8a29361be8247ef3f3e49618c6e765/netid_client-details-01-new)

## Creating a Custom Social Connection in Auth0

To configure Auth0, start by logging in to the [Auth0 Dashboard](https://manage.auth0.com/dashboard). Then, go to **Connections > Social** in the Auth0 Dashboard, scroll to the bottom, and click **Create Custom**.

Next, enter the following values into the configuration screen that appears:

**Connection Name**: `netID`

**Authorization URL**:

```
https://broker.netid.de/authorize?claims={"userinfo":{"birthdate":{"essential":true},"gender":{"essential":true},"email": {"essential":true},"email_verified": {"essential":true},"given_name": {"essential":true},"family_name":{"essential":true}}}
```

> Note: In this URL, you notice the explicit parameter `claims`. This parameter tells Auth0 which claims to ask for from netID. **Please note** &mdash; netID will ignore any data requested via standard scopes (_name, address, ..._) as well as optional/voluntary claims.

netID supports the following claims:

- `gender` &mdash; the gender of the end user
- `given_name` &mdash; first name(s) of the end user
- `family_name` &mdash; Last name(s) of the end user
- `birthdate` &mdash; Date of birth of the end user
- `email` &mdash; email address of the end user
- `email_verified` &mdash; verification status of the email address of the end user
- `address` &mdash; the end user's address
- `country` &mdash; country of the end user's address

You can adjust the claims parameter according to your needs.

**Token URL**: `https://broker.netid.de/token`

**Scope**: `openid`

**Client ID**: `<enter the ClientID you retrieved from netID>`

**Client Secret**: `<enter the Client Secret you retrieved from netID>` (previously referred to as **netID Token - sandbox**)

Copy the following JavaScript snippet into the **Fetch User Profile Script** box:

```javascript
function(accessToken, ctx, cb) {
  request.get('https://broker.netid.de/userinfo', {
    headers: {
      'Authorization': 'Bearer ' + accessToken
    }
  }, function(e, r, b) {
    if (e) return cb(e);
    if (r.statusCode !== 200) return cb(new Error('StatusCode: ' + r.statusCode));
    var profile = JSON.parse(b);
    cb(null, {
      name: profile.given_name + ' ' + profile.family_name,
      family_name: profile.family_name,
      given_name: profile.given_name,
      email: profile.email,
      email_verified: profile.email_verified,
      birthdate: profile.birthdate,
      gender: profile.gender,
      user_id: profile.sub
    });
  });
}
```

### Authorization header

Since netID requires _Basic Authentication_ for authentication, but custom social connections submit the credentials via post body per default, we need to create a custom header for the Authorization and add it to the configuration.

The hash is created by base64-encoding the `clientID` and `clientSecret` concatenated with a `:`. So the pseudo code to generate this would be:

`base64encode(clientId + ":" + clientSecret)`

An [online base64 encoding tool](https://www.base64encode.org/) can also be used to construct this value.

The full header is then constructed as per the [standard authorization header format](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization), setting the type to `Bearer`:

```
{
  "Authorization": "Basic <your base64-encoded token string>"
}
```

You can try out the connection by pressing the **Try Connection** button and, upon success, get a screen like this:

![Testing out the custom social connection](https://images.ctfassets.net/23aumh6u8s0i/2al4mPP0I9ZPMCwdJfSXRP/a82ea4c443fb069b2c4abe18aa57e3b4/netid_config-02)

Under the **Applications** tab, make sure that your client/application is enabled for this custom social connection.

Finally, adjust the **Universal Login Page** configuration and add a few lines of custom CSS to make the netID button appear with the respective logo and coloring. To do this, navigate to the [**Universal Login Page > Login Page** configuration](https://manage.auth0.com/#/login_page) and enable the **Customize Login Page** checkbox. Adjust the source code of the login page replacing the `theme` section in the JSON object with the following lines:

```js
theme: {
  logo:            config.icon,
  primaryColor:    colors.primary ? colors.primary : 'green',
  authButtons: {
    "netID": {
      displayName: "netID",
      primaryColor: "#74b82b",
      foregroundColor: "#fff",
      icon: "https://raw.githubusercontent.com/auth0-blog/auth0-netid-sample/master/img/favicon_trans.png"
    }
  }
},
```

Before:

![The code for the custom login page, before the change is made](https://images.ctfassets.net/23aumh6u8s0i/4fAXiCwgsRc8AdCzv5zd8u/5da7ab28832578872f1002b2877df832/netid_login-page-before)

After:

![The code for the custom login page, after the change is made](https://images.ctfassets.net/23aumh6u8s0i/4uEXHaZk1nO2mQUJ70TytY/6f0baed1947dbb2f54d3df46fdad68d3/netid_login-page-after)

## The Authentication Flow

### Screencast

For more context, you can view the following screencast of the authentication flow to get a better idea of how the integration with netID works:

<iframe width="560" height="315" src="https://www.youtube.com/embed/kY5Wu9FNQ8Y" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

### Authentication

When pressing the login button within the client application, Auth0 provides a login/signup widget with options to login/signup via username and password or via social logins, such as netID.

![Auth0 login screen with netID as a custom social connection](https://images.ctfassets.net/23aumh6u8s0i/69Cyef57ukleYtPp26FrjK/1281c86c93ee9548640695c354c5a037/netid_auth-01)

When choosing netID (we're assuming the end user already has an account at netID), the user will be asked to log in at netID, providing an email address.

> Note: if your client is running in sandboxed mode, as described here, it will only function with the whitelisted email addresses

![The netID login screen](https://images.ctfassets.net/23aumh6u8s0i/7bIMhHWXIhALpVi6cmO5Gl/4340eab10878885b503439f1c11efa37/netid_auth-02)

They will also need to provide their password:

![The netID password entry screen](https://images.ctfassets.net/23aumh6u8s0i/6jS5kZLe5rByfns4J11Ua2/f3f46538668e11338ce89e64792524be/netid_auth-03)

Upon successful login, they will be asked to give consent to netID to grant Auth0 access to their personal information:

![The netID personal information consent screen](https://images.ctfassets.net/23aumh6u8s0i/6qpyibpxShK5AYj03M9p6W/5dbdb7de076d3e8c35e37756dfc9dd60/netid_auth-04)

Furthermore, the demo client asks for consent to access the Auth0 tenant:

![The Auth0 consent screen](https://images.ctfassets.net/23aumh6u8s0i/48oJiahShr5bVO2fTNZ093/1694a5b2c38d2813393be6158efcda25/netid_auth-05)

After consent is given, the browser redirects to the application, having received an ID token and information about the user:

![Logged into a demo app using netID](https://images.ctfassets.net/23aumh6u8s0i/7k0wipMlKPaMB8wXYaZn36/be3ae0e27ac33ad6b9a4993d4ee24a71/netid_auth-06)

## Client App Creation in Auth0

In our example, we chose a **Single Page Application (SPA)** based on **Angular** delivered from a Node.js web server. You can choose any other technology stack as well though. In our case, the client application is created and configured as follows in the Auth0 backend:

1. Create the application by going to the **Applications** section in the dashboard and click the **+ Create Application** button.
   ![Creating a new Auth0 application](https://images.ctfassets.net/23aumh6u8s0i/1axrPu0RywAPmw2XW1zvEn/cee0b91b909cb19d95e62c9f97e8af65/netid_applications-create)
2. Next, give the application any name you like and choose **Single Page Web Application** as the type.
   ![Choosing an Auth0 application type](https://images.ctfassets.net/23aumh6u8s0i/i4uUaBNPyAx2QMlQ8TNhy/b611109b1917096e704310d3a0f4fd2a/netid_app-quickstart-01)
3. Next, choose **Angular** as the technology.
   ![Choosing a technology type](https://images.ctfassets.net/23aumh6u8s0i/1aeo8vqDfCu4JXWYN4q5DL/0a5705bc7ea5c5a772b874b46775af16/netid_app-quickstart-02)
4. Afterwards, you're given the choice to either integrate Auth0 into an existing app, or download a complete sample. Choose the latter and download the ZIP file.
   ![Angular quickstart page](https://images.ctfassets.net/23aumh6u8s0i/4kWcfmuXfKbJNiolIwRlf8/6faae6c438a390dc2fd5c6424ac709d7/netid_app-quickstart-03)
5. Download and unzip the file anywhere on your computer. Then, enter a local terminal window and switch to the folder where you extracted the project into.

To build and run the project, enter:

`npm install`

followed by

`npm start`

This should spin up a local Node.js web server, making the application available at [`http://localhost:3000`](http://localhost:3000).

Returning to the Auth0 dashboard, click the **Settings** tab of the app.

In the application settings:

- set **Application Type** to "Single Page Application".
- set **Allowed Callback URLs** to `http://localhost:3000/callback`
- set **Allowed Logout URLs** to `http://localhost:3000`

![Configuring the Auth0 application](https://images.ctfassets.net/23aumh6u8s0i/6WcPdXxzG1gT067PmKFR6p/f463cd808e252fd69991c5a1a353abe7/netid_auth0-app-settings)

As for the connections, click the **Connections** tab at the top of this page to enable any (other) connections that you want enabled besides **netID**. Note that custom social connections don't show on this screen, they are configured and within the **Custom Social Connections** extension itself. In our example, we chose to also offer authentication via **Username-Password-Authentication**, **facebook** and **google-oauth2**, besides **netID**, thus the respective switches are enabled.

![Configuring app connections](https://images.ctfassets.net/23aumh6u8s0i/3G3jKZ5VPR0n51YZjjQtGo/2e51513ac148e30f1b6e26f4aad9786c/netid_auth0-app-connections)

In the end, the application is listed in the **Applications** overview:

![The Auth0 application registered in the dashboard](https://images.ctfassets.net/23aumh6u8s0i/6J44Uf75tIp0ZE5UQdLUnZ/03232fb39dfeaf774eee2ca9cb59c711/netid_auth-07)

Once a user has gone through the process of logging into their app using Auth0 and netID, the user information can be inspected within the Auth0 dashboard by expanding the **Users & Roles** menu item on the left, and then choosing **Users**:

![The users that have registered with the sample app](https://images.ctfassets.net/23aumh6u8s0i/6GrJ1shfzzbpKC0W08NrWn/0740be76057ce5f10f68b2397fffa321/netid_users-01)

The user's primary identity provider is shown as `oauth2`:

![Viewing detailed information about the registered user](https://images.ctfassets.net/23aumh6u8s0i/4zCj9DeRH9QOM5fjKyg2hQ/b6f66034b30ae57d7ba7a6f2326dafb8/netid_users-02)

and the raw JSON of this user contains the netID identity of the user:

![Viewing raw JSON information about the registered user](https://images.ctfassets.net/23aumh6u8s0i/1LGS9ZCwgbvyIynjppoEun/652a08cfe203d9c80791aba0e459f495/netid_users-03)

### netID backend

The **Meine Daten** (My Data) section for the user within the netID backend:

![The netID "My Data" page](https://images.ctfassets.net/23aumh6u8s0i/4hDziEEJ8yVEk4ZmVfeqlV/5c5b2a949b0d99be1eab946efad11708/netid_my-data)

The user can see an overview of the approved applications/services under **Meine Dienste** (My Services):

![The netID "My Services" page](https://images.ctfassets.net/23aumh6u8s0i/7Ltkxj0vykjZ8PSxvSLVdV/6ecf9bba29b7a901611bb643f836b935/netid_my-services)

The user can always review and revoke their consent that grants the service access to their personal information:

![Revoking consent for the service to access personal information](https://images.ctfassets.net/23aumh6u8s0i/1PJXEAhS2ZOiIKvLOX3L2k/1a4c0e65c7adba9859df446496bd55ea/netid_revoke-service)

## Recap

In this post, you learned how Auth0 can help you add the German identity provider netID as an option for your end users to sign up and login to your web application. You saw how to configure netID as an Auth0 Custom Social Connection and supply all the necessary details to integrate with a netID application. Finally, we showed you a sample login process, and how user data can be inspected both on the Auth0 side, and within the netID portal.


netID Integration Using Custom Connections

956290?s=200

Luke Oliff

Hackference is a three-day conference and hackathon for attendees to learn something new. Auth0 sponsored this year, with Jeremy Meiss giving a compelling talk on using Identity Management providers instead of building your own, on Friday



This year, Auth0 attended [Hackference](https://2018.hackference.co.uk) as a sponsor. Besides [Jeremy Meiss](https://twitter.com/iamjerdog) giving a great talk on [power and value of identity providers](https://auth0.com/blog/5-reasons-your-company-needs-identity-and-access-management/) at Friday's conference, we remained on hand for the rest of the weekend to support the Hackathon.

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">Interesting stuff from <a href="https://twitter.com/IAmJerdog?ref_src=twsrc%5Etfw">@IAmJerdog</a> on Modern Identity and security best-practises <a href="https://twitter.com/auth0?ref_src=twsrc%5Etfw">@auth0</a> <a href="https://twitter.com/hashtag/hackference?src=hash&amp;ref_src=twsrc%5Etfw">#hackference</a> <a href="https://t.co/ItwKmwMAcn">pic.twitter.com/ItwKmwMAcn</a></p>&mdash; Nimvelo (@Nimvelo) <a href="https://twitter.com/Nimvelo/status/1050750593214636033?ref_src=twsrc%5Etfw">October 12, 2018</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

Hackference returns for its 6th year, ran and founded by the amazing [Mike Elsmore](https://twitter.com/ukmadlz). Its purpose is to provide a unique and hands-on learning environment free of any negative influences.

## What You Missed at the Conference

This year, the conference included two tracks: Innovate and Develop. Across these two tracks, speakers included [Doug Sillars](https://twitter.com/dougsillars) on modern image delivery techniques, [Karina Popova](https://twitter.com/kary_key) on geospatial analysis of Twitter content, [Alex Lakatos](https://twitter.com/lakatos88) on natural conversation pieces with bots, and [Jessica Rose](https://twitter.com/jesslynnrose) on a common issue in tech, Burnout. These are to name but a few. [Check out the schedule to see what you missed](https://2018.hackference.co.uk/#schedule).

## Hackathon Winners (of Auth0's prize)

Anna, Carol and Jamie of team "Who Dis?" built an advanced identity service designed to be self-hosted. Based on the IndieAuth login system, their app was created as a custom Auth0 identity provider. When accessing the app, authentication is requested via Auth0's centralised login page where you could select their custom identity provider which could then verify identity.

![Anna, Carol and Jamie of team "Who Dis?"](https://images.ctfassets.net/23aumh6u8s0i/10bWa7pxjl7Kc1xg7VG2d6/4c1ff2871859aaede3f9d42e267cfeb4/hackference-auth0-winners-who-dis)

## Hackathons

Hackathons are an important part of the development world! True innovation and creativity can be expressed in a supportive and collaborative environment, often with the added incentive of some amazing prizes.

Some famous features and products have been born from hackathons. Most notably, the [Facebook “Like” button and Facebook Chat](http://uk.businessinsider.com/facebook-hackathons-2017-6) were both born at company internal hackathons.

In an environment where innovation and creativity are nurtured, amazing things can happen.

These sites will help you find hackathons near you.

-  [Major League Hacking](http://www.mlh.io/)
-  [Hackalist](http://www.hackalist.org)
-  [Hack Club](https://hackathons.hackclub.com/)
-  [Devpost](http://www.devpost.com)
-  [Hackathon IO](http://www.hackathon.io)
-  [HackEvents](http://www.hackevents.co)
-  [HackathonsNear.Me](http://www.hackathonsnear.me)

<include src="asides/AboutAuth0" />


Hackference 2018 Recap

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

An honest look at the Cambridge Analytica data breach numbers. What's next for social login authentication? Time to switch social providers?



In 2015 Facebook learned that Dr. Aleksandr Kogan, a psychology professor at the University of Cambridge, illegally passed Facebook data that he collected with his app, “thisisyourdigitallife,” to the political and military strategy firm SCL/Cambridge Analytica.

Kogan billed “thisisyourdigitallife” as a research app used by psychologists and achieved [270,000 downloads](https://newsroom.fb.com/news/2018/03/suspending-cambridge-analytica/). Each user consented for Kogan to access their personal information, including location, Facebook content they had liked, and friends and connections. 

Cambridge Analytica also obtained data without users' consent from an [additional ~87 million](https://www.wired.com/story/facebook-exposed-87-million-users-to-cambridge-analytica/) accounts and sold their findings to political campaigns, including those of [Ted Cruz](https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz-president-campaign-facebook-user-data), Ben Carson, and [Donald Trump](https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump-campaign.html).

![Cambridge Analytica data breach internal email discussion](https://images.ctfassets.net/23aumh6u8s0i/1a5Zw2zcAYDYMVCjt3ZTSy/4f08f19dfef754ebe3269046a1770238/Cambridge-Analytica-internal-email)

[Source](https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump-campaign.html)

This data leak is one of the largest and most upsetting for users to date, given the strong evidence of how Cambridge Analytica used their information to influence divisive elections.

For the millions of companies that use [Facebook Login](https://auth0.com/learn/social-login/) to authenticate their users, this investigation poses new business and ethical challenges. This article will help teams grapple with how the scandal could affect their operations and offer solutions for moving forward.

## Should You Stop Using Facebook Login with Your Apps?

Shortly following news of the breach, [Facebook launched an apology ad campaign](https://www.fastcompany.com/40563382/facebook-says-sorry-sort-of-in-its-biggest-ever-ad-campaign) aimed at helping users steer clear of dishonest accounts on its platform that could be attempting to steal their information.

![Facebook post-data-breach apology ad campaign](https://images.ctfassets.net/23aumh6u8s0i/6XPV549H4eXuYj4K8w7mUK/72619ae21946bb22a584b0426037442f/apology-ad-campaign)

 [Source](https://www.wired.com/story/facebook-launches-a-new-ad-campaign-with-an-old-message/)

While the campaign provided some good insights, it also highlighted staggering issues within Facebook — particularly how the company has scaled without paying close enough attention to certain user behaviors. 

From fake accounts to clickbait, spam, and more, it appears like [Facebook could be a messy platform to continue to authenticate](https://auth0.com/learn/social-login/) with — at least in the near-term. 

Moreover, it could be a challenge to explain to your users why you are continuing to collect their Facebook data.

### Solution 1: Use Other Forms of Social Login

You have a series of other options for authenticating your users.

![Auth0 Social Connections dashboard](https://images.ctfassets.net/23aumh6u8s0i/4YehQWoR0H6GnHZjbj5H5D/e834bc799a7c04035ff4dc3e54ac6ce7/auth0-social-connectors)

[Auth0 supports 30+ social providers, including Twitter, Google, Yahoo, and LinkedIn](https://auth0.com/learn/social-login/). You can also just add any OAuth2 Authorization Server you need. Despite differences among each provider, Auth0 simplifies the process by unifying the way to call providers and the information you retrieve from them.

It's simple to switch providers in the Auth0 dashboard. If you haven't already, you can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>. Then, simply click [Connections, then Social](https://auth0.com/learn/social-login/). To enable a new provider, just flip the switch next to their icon. You can then select the desired attributes and permissions you want to get from the provider in the configuration popup.

### Solution 2: Incorporate Simpler and More Visible Means of Obtaining User Information

[Progressive profiling](https://auth0.com/blog/progressive-profiling/) is another technique for gradually building up a profile of your customers. Each time they interact with your product, you display a short questionnaire. It can begin with something as simple as requesting a first and last name:

![Auth0 registration signup with expanded first and last name fields](https://images.ctfassets.net/23aumh6u8s0i/6c1CdEctffMU2WUx3oFDsQ/7cd3336e0c18ae25a94fa341b032c62f/auth0-registration-form)

From there,  you can continue to get more specific — but in small increments:

![Auth0 progressive profiling form](https://images.ctfassets.net/23aumh6u8s0i/3FMpAM4y5mzmPPhgtu1hgf/da847942e43f5d4586f8b351f7484330/auth0-progressive-profiling-form)

Progressive profiling allows you to keep these forms short and to the point and collect data in a clear and transparent way. You will slowly build up a robust customer profile that affords you the same power as a Facebook profile does to send better, more targeted offerings to your customers.

### Employ Good Privacy Policy UX

Whichever authentication method you go with, make sure you clearly explain your process to your users. While this is critical for [complying with GDPR and related measures](https://auth0.com/docs/compliance/gdpr), it is also an opportunity to highlight the benefits of why you are doing so. Are you helping deliver to customers the content they actually want to receive? Avoiding showing them products or hyping services that are irrelevant? There is a lot of information you can incorporate alongside legal jargon that shines a light on how thoughtful your team is with its operations.

Starting gradually will help assure your users of your expertise at the outset without overwhelming them with technical information.
 
![Microsoft form explaining usage of birthdate](https://images.ctfassets.net/23aumh6u8s0i/5IHR68eJ55yVT7yvrtKEE1/855e00d6187589bdd8ae7297e0865da5/microsoft-form-explaining-usage-of-birthdate)

[Source](https://www.econsultancy.com/blog/69256-gdpr-how-to-create-best-practice-privacy-notices-with-examples)

Adding an automatic text window, like Microsoft does, that appears when requesting data points enhances the user experience in a clear and simple way. From there, you can prompt viewers to click through to a larger policy statement. If they continue to be curious, place links for them to dig even deeper:

![Microsoft privacy policy sample](https://images.ctfassets.net/23aumh6u8s0i/7cfutBnxv1JwnS9IFPvCE4/26deebc81cef26a3c02ce50e1f611060/microsoft-privacy-statement)

[Source](https://www.econsultancy.com/blog/69256-gdpr-how-to-create-best-practice-privacy-notices-with-examples)

If you're daunted by crafting all of this text yourself — ensuring it is both accurate and digestible —  there are many privacy policy templates online. If you're an e-commerce company, for example, [Shopify](https://www.shopify.com/tools/policy-generator) offers a series of tips and tricks. 

Remember: investing in current customers can actually produce better results than attracting new ones. Taking the time to open up to those currently engaged will spur them to create more value for you in the long run.

## Just Because You Rely on Facebook Login, Doesn't Mean There Isn't a Way Forward

Although Facebook has frustrated many companies with its lack of oversight in the wake of the Cambridge Analytica data breach, it still has enormous resources at its fingertips to (hopefully) help it improve. While we wait for the tech titan to rebuild user trust (and perhaps become a beloved tool for business partners once more), the above solutions will help you continue to research, protect, and delight your users. 

<include src="asides/AboutAuth0" />


What Data Did Facebook Really Give Cambridge Analytica?

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

How the right fit can help you source more value from your IT team and secure critical data.



Many believe managed service providers (MSPs) [can’t add value](https://auth0.com/blog/managed-service-providers-myths/) to an IT team. Because MSPs are outsourced providers, some managers and engineers feel an MSP won’t truly have a stake in maintaining the quality of their systems and protecting their [sensitive user data](https://auth0.com/blog/the-6-billion-reason-your-business-needs-advanced-fraud-protection/).

While some risks do exist when shifting control to an external group, [strong evidence](https://auth0.com/blog/managed-service-providers-myths/) shows that outsourcing some or all of your IT operations can up your ability to deter cyberthreats and improve your company’s overall level of expertise. What’s more, although MSPs may charge a high upfront cost, they can reduce maintenance charges by [40%](https://www.cisco.com/c/dam/en_us/services/downloads/why-managed-services.pdf) over time, leading to enormous company savings over the long haul.

This article will help you decide when and how to bring in these experts. When you do, we'll show you specific ways they can make your IT operations more efficient so you can continue to grow your core business.

<include src="TweetQuote" quoteText="Learn to know when and how to bring in external expertise to make your IT operations more efficient!"/>

---

## What Is a Managed Service Provider?
Managed service providers are third-party technology experts, hired to help scale, monitor, and update various aspects of an organization's IT systems.

MSP roles have evolved over the past decade from simply maintaining legacy systems to taking responsibility for repairs and patches and delivering new software, cloud services, and specific expertise, such as data security services. Top full-service MSPs like Accenture, Cognizant, and IBM have teams of experts, dedicated to remotely managing their customers’ entire IT infrastructure. These and other MSPs can allow companies to quickly expand by offering to host operations at a more robust and powerful external data center. By shouldering the majority of routine maintenance work, MSPs allow IT teams to focus on vital tasks instead of using up valuable resources to keep systems from crashing.

MSPs can also help a company stay up-to-date with the latest tools and emerging trends, such as how to efficiently transition to the cloud and access [energy-saving technologies](https://www.energy.gov/eere/femp/energy-efficiency-data-centers). Finally, they can secure organizations against [data breaches](https://www.ibm.com/security/data-breach), which have the potential to significantly set a company back financially and damage its reputation among customers.

## How a Managed Service Provider Can Improve Your IT Operations
A managed service provider can help your team in several specific ways. Whether it's a specialized MSP (e.g., offering only cloud services) or an all-inclusive provider, the decision to hire an MSP and the subsequent management of this external provider will bring some key changes and benefits to your team.

### Source More Value From Your IT Team
Hiring an MSP can propel you to streamline your workflow and dedicate more manpower to mission-critical tasks. To make sure your [outsourcing](http://www.rethinkstaffing.com/smart-staffing-solutions/dont-lose-control-over-outsourcing-actively-managed-services) is efficient, start by parsing out which parts of your IT team's work you want to offload to the MSP and which you'd like to remain in-house. The following sequence will help you through the process:

1. Figure out what parts of your IT operations are causing the biggest drain — in both human and financial resources. Many find this to be maintenance. A report by Cisco finds that [65%](https://www.cisco.com/c/dam/en_us/services/downloads/why-managed-services.pdf) of IT budgets go towards just keeping systems powered up. For this reason you might consider outsourcing your network support so you don't spend all day reacting to and troubleshooting issues as they arise.
2. Decide on an MSP that will be the best match for your specific needs. Further criteria to consider are the vendor's size, its location, its ability and experience in offering hybrid solutions (if that's your team's trajectory), its data center capabilities, and price.
3. Once you've made your decision, a strong and effective MSP relationship requires the customer (you) to set clear expectations in a scope of services or [service level agreement](https://www.continuum.net/europe/blog/5-ways-to-strengthen-your-service-level-agreement-sla) (SLA). You can begin with a template SLA, then customize it based on your unique needs. For example, if you need coverage 24-hours a day, the SLA is the place to say so.

A wide range of organizations relies on SLAs when outsourcing their IT needs — from growing companies to government agencies to large non-profits and universities like UC Santa Cruz (below). The following is an overview of their SLA for data center services, 2017-2019, along with a breakout of their service scope:

![Service Level Agreement](https://images.ctfassets.net/23aumh6u8s0i/1nKypCC7AhUEYR9iT2U7TV/e92ca4386bc1589e9b20001ff6bcd784/1-sla)

> [Source.](https://its.ucsc.edu/sla/data-center.html)

In the Quicklinks bar on the right, it's clear that the full SLA digs into everything at a granular level — from the MSP's roles and responsibilities to hours of coverage and response times, pricing, reporting, and more. The services scope details the suite of services the provider will deliver, including authentication for the campus active directory, data backup and recovery, and hosting. It is comprehensive and reflects the time UC Santa Cruz put into understanding its own needs and clearly spelling them out for the external provider.

With a team of well-supported experts who are highly dedicated to customer service, managed service providers have the capacity to take an enormous load off of your IT team's shoulders and deliver value over and above your current state. Figuring out how to manage this relationship correctly can drive enormous efficiencies within your IT operations and secure a strong technology base for your company's overall expansion.

### Tighter Security
One of the _top reasons_ that companies hire MSPs is for their security expertise and ability to deter cyberthreats. [Identity and access management](https://auth0.com/blog/5-reasons-your-company-needs-identity-and-access-management/) is a key service that certain specialized MSPs like [Auth0](https://auth0.com) provide. This service is particularly critical for organizations undergoing a digital transformation.

For example, when shifting operations to the cloud — whether a public, private, or hybrid model — managing the number of permissions and access points to your most critical workstreams is essential. With a myriad of off-premises users now accessing this sensitive information, making sure you have a sharp eye on who, when, and how each of them is logging in will go a long way towards mitigating [user fraud](https://auth0.com/blog/the-6-billion-reason-your-business-needs-advanced-fraud-protection/).

A specialized managed service provider, Auth0 offers "Rules" to customize user access. [Rules](https://auth0.com/docs/rules/current) are JavaScript functions, which run on Auth0 servers to create a customized login process. Rules allow Auth0 customers to build robust checks and log user behavior throughout the system (i.e., password re-sets, date, locations, and devices of all log-ins).

Auth0's centralized dashboard allows you to manage your users in a variety of ways:

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/3fA99OTS2zD1WkndaDa2YS/7513d96ccf2c71d9d391e408f9af5d30/2-auth0-dashboard)

For example, as you observe current and past activities, you could deny certain users access, request password re-sets, enable multi-factor authentication for enhanced security, and more. In 2017 the average cost of a data breach was [$3.62 million](https://www.ibm.com/security/data-breach), yet you can significantly decrease this risk by implementing better identity security measures. In 2017 Deloitte could have avoided its [massive data breach](https://www.theguardian.com/business/2017/sep/25/deloitte-hit-by-cyber-attack-revealing-clients-secret-emails) just by tracking its users more carefully.

<include src="TweetQuote" quoteText="In 2017 the average cost of a data breach was $3.62 million!"/>

These features are complex and time-consuming to build in-house; plus, they require continual updates to ensure they remain as tight as possible. Outsourcing identity and access management needs to a specialized MSP is a great strategy for securing your most sensitive information as you transition to a digital environment.

## Ready to Scale? Time to Call in an MSP
If your team is ready to move to the cloud and has market traction and funding for further growth, your IT needs will only escalate. Bringing in an MSP will help you to scale efficiently and sustainably. A managed service provider is perfect for a small or medium-sized business with limited in-house abilities yet the resources to pay up-front costs.

Over time you'll pay back a significant portion of this capital expenditure. (Studies show MSPs can save you [50% of your annual IT costs](https://www.webroot.com/shared/pdf/wp-transitioning_to_managed_services.pdf).) However, companies without the ability to pay the initial costs and/or that do not have a present need for enhanced security measures and organizational support (such as a startup beginning to pilot test a new app) might do without.

In addition, if you lack expertise in a certain critical area, such as securing user data, particularly as [GDPR and subsequent privacy regulations](https://auth0.com/blog/gdpr-effect/) loom, it's time to consider hiring outside support.

<include src="TweetQuote" quoteText="Bringing in an MSP where it matters will help you to scale efficiently and sustainably!"/>


What Are Managed Service Providers?

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Learn how to use the new SparkPost integration with Auth0.



We have recently added support for one more e-mail provider to the [Auth0](https://auth0.com/) platform: [SparkPost](https://www.sparkpost.com/). In this short tutorial, we will learn how to enable custom e-mail providers in Auth0 and how to setup SparkPost for all Auth0 related notifications. Read on!

<include src="TweetQuote" quoteText="Learn how to use SparkPost to send e-mails for your Auth0 apps!"/>

---

## Introduction
Flexibility is one of the most important parts of the Auth0 platform. In fact, it is so important to us that we even [developed a product](https://auth0.com/extend/) to help others add flexibility to their architectures. One of the many pieces that can be configured to our customers' likings is the e-mail provider. E-mail providers, in the Auth0 platform, are external services that handle the delivery of all e-mails generated by our identity platform. For example, when a new user registers his or her e-mail address during a common user + password signup process, an e-mail is sent to the user's mailbox to validate the address. On [passwordless logins](https://auth0.com/passwordless) with e-mails, an e-mail is sent to the user's registered e-mail address, etc.

These tasks, by default, are handled by our internal e-mail service. However, the built-in service has several limitations:

- Customization of the content of the e-mails is very limited.
- Rate limiting is always in place.
- All e-mails are sent from a single address.
- High bounce rates to specific destination addresses may limit your ability to send e-mails to other addresses.

These restrictions are very limiting for a production environment. For this reason, it is strongly recommended that customers choose one of the integrated e-mail providers. At the moment, there are five alternatives for sending e-mails:

- The limited built-in service
- [Custom SMTP](https://auth0.com/docs/email/providers#configure-a-custom-smtp-server-for-sending-email)
- [Mandrill](https://auth0.com/docs/email/providers#configure-mandrill-for-sending-email)
- [SendGrid](https://auth0.com/docs/email/providers#configure-sendgrid-for-sending-email)
- [SparkPost](https://auth0.com/docs/email/providers#configure-sparkpost-for-sending-email)

[Mandrill](https://www.mandrill.com/), [SendGrid](https://sendgrid.com/) and [SparkPost](https://www.sparkpost.com/) are three e-mail service providers with powerful APIs to interact with their service. Additionally, full flexibility can be achieved through the use of a [custom SMTP server](https://auth0.com/docs/email/providers#configure-a-custom-smtp-server-for-sending-email). This alternative allows you to setup any provider (or your own server) as long as it provides an SMTP interface.

In this post, we will focus specifically on [SparkPost](https://www.sparkpost.com/). Other e-mail providers, except for the generic Custom SMTP option, can be configured in a similar way.

## Step 1: Get an Auth0 Account
If you haven't done so already, register for a <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">free Auth0 account</a>. The free tier provides all that's necessary to get a small application up and running with as many as 7000 active users and unlimited logins! Of course, you can also setup your own e-mail provider. Customization options for e-mail content are limited though. But this won't be an issue for our tutorial.

Normally, after signing up, you would create a new [Client](https://auth0.com/docs/clients) using the Auth0 dashboard. Clients identify different applications that interact with the Auth0 server. In other words, if you were to develop a mobile application that authenticates users at some point, you would create a client for that application.

For this tutorial, however, we won't be using any clients, so you can simply sign up and move on to step 2.

## Step 2: Get a SparkPost Account
We will also need a SparkPost account. Go to [www.sparkpost.com](https://www.sparkpost.com/) and click on the `TRY FREE` button on the top right corner of the screen. Complete your user information and follow the steps.

At some point during the sign-up process, you will be presented with an API-key. Take note of this value and store it somewhere safe. You will not be able to get this value again from the SparkPost dashboard. Worry not! If for some reason you forget this value, you will be able to invalidate that API key. You can also create as many API keys as you want from the dashboard.

The API key is used to authorize external users of the API. In other words, this *token* is what allows external services, like Auth0, to interact with the SparkPost API. You will need to inform Auth0 of this value at some point (hint: the next step). Do note that the API key should be considered a **private** value. In other words, do not expose the API key to any services or users unless required. Any holder of the API key can interact with your SparkPost account using the level of access associated with that API key. If you take a look at the SparkPost API key creation screen you will note that there are many checkboxes:

![SparkPost API key creation](https://images.ctfassets.net/23aumh6u8s0i/3CBxDBZwKFGuMBLLYxVW4G/a0ce436cce22b652e62a2e495eadc667/api-key)

These checkboxes are the permissions associated with the API key about to be created. Any holder of the key has access to those permissions. Auth0 integration only requires a single level of access: `Transmissions: Read/Write`. `Transmissions` are a component of the SparkPost service architecture that allow sending e-mails (single and bulk e-mail operations).

## Step 3: Set API Key in the Auth0 Dashboard
This is the most important step! Now that you have both an Auth0 account and a SparkPost account along with a valid API key, it's time to tell Auth0 about it. Go to the [Auth0 Dashboard](https://manage.auth0.com/) and find the [E-mail Providers section](https://manage.auth0.com/#/emails/provider). Enable custom e-mail providers by toggling the `Use my own Email Provider` button. Now select `SparkPost`. You will be presented with the following screen:

![Auth0 SparkPost API key input](https://images.ctfassets.net/23aumh6u8s0i/2MIZ6ubOdTLHnTYjxAKlQp/eff32aae22e9d8b2c1ee04546f0d938e/auth0-api-key-input)

It really is as simple as that! Put your API key in the input box at the bottom, and put a valid e-mail address at the top. SparkPost places some limitations on the e-mail addresses that are valid for use here. These are all detailed in [SparkPost's documentation](https://developers.sparkpost.com/api/transmissions.html), however, to avoid unpleasant surprises we'll review some of these limitations here:

- To use a custom domain for sending emails, that domain must be validated once using the [SparkPost domain validation process](https://developers.sparkpost.com/api/sending-domains.html). The relevant section of SparkPost's dashboard is [this one](https://app.sparkpost.com/account/sending-domains).

- Custom domains must match **exactly** the validated domain. In other words, if your validated domain is `mail.mysuperdomain.com` you must pick an address that looks like `mymailbox@mail.mysuperdomain.com`. Variants like `mymailbox@mysuperdomain.com` or `mymailbox@mail2.mysuperdomain.com` are not valid. If you don't want the `mail` subdomain to be part of your e-mail, make sure to validate the root domain and not the subdomain using SparkPost's domain validation process. Whatever goes before the `@` is not important, though, you can pick whatever you want.

- There is a domain that can be used for tests in case you don't have a custom domain at the moment: `sparkpostbox.com`. This is known in SparkPost's documentation as the [sandbox](https://developers.sparkpost.com/api/transmissions.html#header-the-sandbox-domain). SparkPost's sandbox domain has strict limitations and should only be used to test that things work once or twice. In fact, there is a hard lifetime limit of five test e-mails from that domain. In other words, after five test e-mails, you won't be able to send any more using that domain. You can use this domain to test the integration with Auth0 but be aware that things will fail after those five e-mails have been sent. Sandbox domains are of the form `mailbox@sparkpostbox.com` where `mailbox` can be anything you want.

With all of this in mind, we might want to test things using the sandbox domain (just one mail this time!). Put a sandbox domain e-mail address in the input box at the top, like `test@sparkpostbox.com` and hit `SEND TEST EMAIL`. In a few seconds, you will receive an e-mail in your main Auth0 e-mail address. This is the e-mail that you used when you signed-up for an Auth0 account. Check it out!

## Step 4: Setup a Custom Domain in SparkPost
SparkPost's sandbox domain is very limited. For this reason, it is very important to setup a custom domain as soon as possible. Fortunately, if you already own a domain this is very simple. If you don't, getting one is out of scope for this tutorial. Fortunately, there are many tutorials on getting a domain on the internet. If you need to buy one, do that and then return to this step. For instance, you can buy one from [Google](https://domains.google/#/) or you can use [Vercel's excellent now.sh service](https://vercel.com/domains) to buy one from the console.

To access the domain verification screen, go to [SparkPost's dashboard](https://app.sparkpost.com/dashboard), then go to `ACCOUNT`, `SENDING DOMAINS` and read the `Set Up For Sending` section.

If you already have a custom domain you will need to decide what process you will use to validate it. SparkPost provides the following validation alternatives:

- Let SparkPost send an e-mail to your custom domain and then follow the link there.

![Sending a verification email](https://images.ctfassets.net/23aumh6u8s0i/7sZ7mzEkF9nzcSI3d4Vp93/edc1b4168eebd1d1d8fcd448e76baa0c/verification-email)

- Put a special entry in your DNS server configuration.

![Special DNS entry](https://images.ctfassets.net/23aumh6u8s0i/48Q0lIEnijsYhcqo2RGb8x/231cccc44488c85c0d21ad8fd3b537db/dns-domain-verification)

Both alternatives are simple enough, however, if you do have the capability to receive e-mails in your domain, this is the simpler, faster option. In contrast, DNS changes may take time to propagate and require especial access credentials to your DNS service or server.

Do note that SparkPost recommends using DNS verification for your domains.

## Step 5: Handling Errors and Failures
Now that you have a fully working integration with SparkPost, it is important to know how to debug things in case anything goes wrong. There are two places to look for important clues: [Auth0 logs](https://manage.auth0.com/#/logs) and the [SparkPost reports](https://app.sparkpost.com/reports/message-events). Normally, Auth0 logs would only show failures in case the API key is invalid or SparkPost is down, for all other issues you should check SparkPost's reports.

To reach [Auth0 logs](https://manage.auth0.com/#/logs) go to the [dashboard](https://manage.auth0.com/) and then click on `Logs` on the sidebar.

![Auth0 logs](https://images.ctfassets.net/23aumh6u8s0i/hKqck0ZEFwkhThKJCXihK/4f74f8d25099bd79fc48a7b7ee29cac0/auth0-logs)

To reach [SparkPost's reports](https://app.sparkpost.com/reports/message-events), go to [SparkPost's dashboard](https://app.sparkpost.com/dashboard) and then click on `REPORTS` on the side panel. Inside the reports section, the `MESSAGE EVENTS` section is the most important. You will find detailed descriptions of what is going on with each message in this section.

![SparkPost message events](https://images.ctfassets.net/23aumh6u8s0i/YulzcO4du4LaT1GI7Vne9/192a8ceaa6e59f9ebbdb0db4ac81a548/message-events)

Before getting worked up if things don't work, do remember two important limitations from SparkPost's service: the sandbox domain (sparkpostbox.com) hard limit of five test e-mails, and strict matching of validated custom domains.

## Conclusion
Using custom e-mails providers with Auth0 is very important for a production environment. Although Auth0's built-in service is a great test tool, it cannot match dedicated services like SparkPost. If you want great customization options, rate-limiting that suits your use case, custom send addresses and no limits with regards to bounced e-mails count, you must adopt a dedicated e-mail provider. Fortunately, integration with services like SparkPost, as we have seen in this post, is a breeze. And even then, if you don't find any of the alternatives fitting to your use case, you can still fall back to a custom SMTP solution. Flexibility is part of Auth0's architecture.

<include src="TweetQuote" quoteText="Auth0 is flexible platform! Setup a custom e-mail provider using SparkPost or other alternatives."/>


Using SparkPost as a Custom E-mail Provider with Auth0

Seven myths about managed service providers. Separating facts from fiction to explain the real value of MSPs.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---
When it comes to Managed Service Providers (MSPs), IT professionals either love them or hate them. Whether you've had a good experience or a bad experience, it's important to understand that all MSPs are not created equal.

MSPs are third-party technology experts hired to monitor and maintain different aspects of a company’s IT systems. The concept is only a decade old. Like most young industries, there are exceptional providers and some not-so-exceptional. As the industry matures, the higher-quality MSPs are separating themselves to provide a compelling IT support option.

![MSPs vs PC Repair](
https://images.ctfassets.net/23aumh6u8s0i/1caYJwPTXSCL9SqawwTd8e/f29b3b5f551121bb1909d5b91cf66110/msps-vs-in-house.png)
[*Source*](http://zumatech.com/pc-repair-vs-managed-service-provider/)

[Despite an expected staggering market increase](https://www.businesswire.com/news/home/20170913005656/en/Managed-Services-Market-2017---Global-forecast) from $152.45B to $257.84B in the next five years, many IT professionals who have been burned by a poor-quality MSP still find it hard to change their perception. While everyone is entitled to their opinion, there is now overwhelming support for the efficiency and effectiveness of higher-quality MSPs. 

To help you separate fact from fiction, we’ve put together seven common misconceptions about MSPs that we found to be, well — myths.

## Myth 1: Operational Quality Goes Down

Outside consultants are not going to care more about the quality of your technology and data than your internal team. If you outsource the responsibility of running your company's critical operational systems, performance will suffer. You can't afford a slow response to downtime.

### Myth Busted!

The technology landscape has evolved, from a centralized system managed by IT to a complex web of specialized technologies and networks outside the expertise of IT.

The right MSP offers a unique opportunity to tap into people that specialize in their specific fields. They are more likely to stay up to date with emerging tech trends than your IT team, who is overwhelmed trying to maintain your entire system. When you hire specialists for certain aspects of your system, you will drive efficiencies in that area. 

![Specialists vs Generalists](
https://images.ctfassets.net/23aumh6u8s0i/47kqqLyJHzFLlN5ISyyKR/58eec358d46a55a91d2f4bcdaa67b68d/specialists-vs-generalists.jpg)

[According to a 2017 Cisco study](https://www.cisco.com/c/dam/en_us/services/downloads/why-managed-services.pdf), their MSP offering increased client efficiency by 60%. In addition to providing experts within each specialized component of IT, MSPs are typically available 24/7, maintaining your systems with minimal downtime.

## Myth 2: Company Data is Less Secure

Cyber attacks are inevitable and [the average cost to fix the damages and recover data is a whopping $879,582](http://www.techadvisory.org/2017/01/cyber-security-and-managed-services/). If your company is hacked, MSPs will lose nothing. Why would they go above and beyond to protect your data?

### Myth Busted!

An MSP won't stay in business for very long if they don’t understand the importance of security and implement every possible measure to keep your systems and data safe. [As it turns out, the top reasons](https://blogs.technet.microsoft.com/hosting/2017/03/22/cloud-hosting-survey/)companies hire MSPs is for their security expertise and ability to stay on top of trends to ensure security is always updated to deter new threats. 

![Quality MSPs Prioritize Security](https://images.ctfassets.net/23aumh6u8s0i/5MMyEwoJPiW4tu3hsPrNLJ/524c174b25e1140592b31236ce9e81ef/msps-prioritize-security)
[*Source*](http://www.yellowspring.co.uk/admin/resources/managed-services-circle-w640.png)

For example, a security MSP like Auth0 is not only an expert in [identity access management](https://auth0.com/blog/5-reasons-your-company-needs-identity-and-access-management/), but they are constantly developing new technology features to modernize and stay ahead of the industry. As an MSP customer, you benefit from this innovation while your IT staff focuses on your business initiatives.

When your core business is to manage technology solutions for multiple companies, your top priority is to have the best and most comprehensive security systems to keep your client’s data safe.

## Myth 3: MSPs are More Expensive

Hiring an outside company to cover tasks that your current staff already manages is a waste of money. In addition to high monthly fees, the operational cost savings that MSPs often promise are not guaranteed. It's hard to validate the costs.

### Myth Busted!

Countless [*studies*](https://www.webroot.com/shared/pdf/wp-transitioning_to_managed_services.pdf) and surveys have shown that hiring an MSP is not only more cost-effective, but your company will likely enjoy considerable operational savings by 50% or more.

![MSPs offer long term cost savings](https://images.ctfassets.net/23aumh6u8s0i/3jMBfKwiyqo40JuAH9XWtz/62f38ccbb98c0cbf706f5fbcb880072d/msps-offer-longterm-savings)
[*Source*](http://www.catapultsystems.com/services/managed-services/)

Internal IT is one of the highest and most unpredictable expenditures. Most of the established budget ([*up to 65%*](https://www.cisco.com/c/dam/en_us/services/downloads/why-managed-services.pdf)) is dedicated to maintenance. According to a 2017 Cisco [*study*](https://www.cisco.com/c/dam/en_us/services/downloads/why-managed-services.pdf), MSPs reduce these recurring, in-house costs by 40% and frees your IT team up to be more proactive.

## Myth 4: IT Loses Control of Operations

The renewed importance of data and technology has elevated IT managers to rock star status in most companies. When some of their responsibility is outsourced to an MSP, there is a loss of control that threatens managers causing friction.

### Myth Busted!

Losing control of your operations is not a result of hiring an MSP. It's a sign of a lack of effectively managing your [*outsourcing*](http://www.rethinkstaffing.com/smart-staffing-solutions/dont-lose-control-over-outsourcing-actively-managed-services). The control that you give up is dependent on what you allow your vendors to take.

![MSPs offer SLAs](https://images.ctfassets.net/23aumh6u8s0i/19gO9rtVARasj7XTjCPr9h/cefbc7bab8d8831349a92e09ff48cee9/msps-offer-slas)

An effective MSP relationship requires setting clear expectations, a scope of services and a [strong service agreement](https://www.continuum.net/europe/blog/5-ways-to-strengthen-your-service-level-agreement-sla) (SLA). By understanding the level of control you’d like to maintain before you hire an MSP, you will be able to define your requirements beforehand and select the right partner that won't challenge your control.

## Myth 5: Transitioning Creates Internal Confusion

When new technologies are introduced to a company, there is an adoption period where employees learn how to use the new tools. Hiring an MSP is going to cause a period of confusion and stall productivity as everyone gets up to speed.

### Myth Busted!

The majority of MSPs are used for highly technical aspects that have a very little impact on your internal team's day-to-day activities. In fact, [most companies](https://www.csoonline.com/article/2934493/infosec-staffing/top-five-reasons-companies-are-avoiding-managed-services.html) (72%) use MSPs for back up and disaster recovery followed by antivirus/spam filtering (68%) and storage management (64%). 

![Managed Services Used Last Year/Coming Year](https://images.ctfassets.net/23aumh6u8s0i/5gN0SD04zOGN1V2BLMD1rO/b90cafeaacf3bce405e2b02ae5a28644/msps-last-year-vs-this-year)
[*Source*](https://blogs.technet.microsoft.com/hosting/2017/03/22/cloud-hosting-survey/)

Most of your employees will never interact with these types of services. MSPs are designed to handle the tedious work of maintaining the backend technology, which frees up IT from focusing on recurring technical tasks. Overall, both IT and general employees should feel less of a burden working with a managed service provider.

## Myth 6: MSPs Can't Help You Differentiate

MSPs grow their businesses by gaining more new customers. If MSPs provide the same services to all these companies, your technology and data will lack differentiation and lose its competitive advantage.

### Myth Busted!

The advantage of an MSP is not to deliver a custom technology solution that will give you an advantage over your competition. The benefit of outsourcing the technical, non-strategic aspects of IT to a managed service is to free up valuable time for you to focus on leveraging your data for growth.

![Lack of time is actually a lack of prioritiies](https://images.ctfassets.net/23aumh6u8s0i/6s0PR1DjvG7QkUxL1BWEFC/c3e2372d9f5d46c36d41181205a5a7c3/lack-of-time-is-actually-lack-of-priorities)

An MSP can help lower costs and take over the time-consuming tasks that keep the business running smoothly. It's up to you and your team to outsmart, outwork and outlast your competition.

When [65%](https://www.cisco.com/c/dam/en_us/services/downloads/why-managed-services.pdf) of your current IT time is spent 'keeping the lights on', you are wasting an opportunity to outsource that work, so that the technology professionals within your organization can use their skills to promote growth.

## Myth 7: Your IT Team Will Be Fired

When you outsource work, people assume you are downsizing to cut costs. Your IT staff will fear being fired if you present the idea of hiring an MSP.

### Myth Busted!

While it is impossible to predict the fate of your IT team, MSPs are not the reason IT people are let go. In a recent survey by [CompTIA](https://www.comptia.org/resources/2016-managed-services-buying-guide), only 6% of companies that hired an MSP eliminated their in-house IT team. The vast majority of companies see MSPs as a way to help IT reprioritize its role.

![Outsource vs In-house](https://images.ctfassets.net/23aumh6u8s0i/6ezhih9u9r3dwChKeDhTVw/d137b05d610f06ffe5f7c76fc6e5b4cc/outsource-vs-inhouse)
[*Source*](http://thelinkmarketing.ie/digital-marketing-outsource-v-inhouse-marketing/)

The smartest approach to hiring an MSP is to identify the complementary needs that your IT staff does not have the time or expertise to maintain. This way, the MSP becomes a support system for your internal staff, not a threat.

## An Effective MSP will Empower Your Internal IT

Every business, big and small, must deal with the reality that technology is the foundational layer of its operation. Every business function—from support systems to revenue-generating initiatives are all tied to technology. 

Managed services is a great option if you are looking to free up internal IT staff so they can focus on other initiatives that support company growth. By outsourcing the more technical tasks like identity access management or infrastructure monitoring to specialized experts, your IT team will have the opportunity to create more strategic value with your company's technology.


Busted! Seven Myths About Managed Service Providers (MSPs)

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Learn why universal login is the most secure, standards-based strategy when authenticating with a provider.



**TL;DR:** To maintain a successful application, you will inevitably need a universal account system, as opposed to embedding login within your application. Universal login is more secure, standards-based, maintainable, and future proof. This is where the industry is moving, and in this post, we will explore this trend.

---

## Introduction

High standards of security and ease of use have been set for modern authentication platforms and APIs. Users expect seamless logins that work across apps and entities without requiring them to log in over and over on the same device. Companies and developers expect robust security for their data and top-notch protection for their customers, preferably without incurring intensive implementation or maintenance overhead.

### What is Universal Login?

**Universal login** refers to a [method of login hosted by the authentication provider](https://auth0.com/docs/hosted-pages/login) for your app or site. A link or button in your app triggers an authentication request and users are then presented with a login experience provided by the authentication provider. Because authentication is taking place on the same domain as the login, credentials are not sent across origins. Universal login is the most _secure_ way to authenticate users, as well as the most _standards-based_. We'll cover <a href="#why-use-universal-login" target="_self">how and why</a> in much more detail below.

### What is Embedded Login?

**Embedded login** refers to a method of authentication wherein credentials are entered via an experience that is _embedded_ on an app's domain with text inputs and are then sent to an authentication provider for verification and login. This is a _cross-origin_ request. Embedded logins present a range of potential security and implementation challenges that cause issues for developers and users; as a matter of fact, [Google no longer supports an embedded approach when implementing OAuth](https://auth0.com/blog/google-blocks-oauth-requests-from-embedded-browsers/).

### What Do Universal and Embedded Login Look Like?

![Universal vs. embedded login](https://images.ctfassets.net/23aumh6u8s0i/5lXoFh88lNEZ41N8NOORYA/35ade19a2e6603719c1338329b948174/centralized-embedded-diagram)

1. **Universal Login** - When clicking a button or link to authenticate in both the browser and native app, the universal login URL at [accounts.google.com](https://accounts.google.com) is loaded.
2. **Embedded Login** - When clicking a button or link to authenticate in the browser, an overlay modal is opened on the same domain, prompting the user to log in. The mobile app also displays input fields within the app.

## Why Universal Login is a Long-Term Investment

Let's look at a hypothetical example using a timeline from an imaginary company. Let's say our make-believe company, "SourceCentral", provides public and private source control repository hosting. Their timeline looks something like this:

![Hypothetical timeline for a service switching to universal login](https://images.ctfassets.net/23aumh6u8s0i/6wzVEf7a5UREYmGYdQ5yZl/d9a04c1906342c8ad2cb5035228fddce/timeline2)

* **Year 0: Launch!** We launched a source control repository hosting service. Our homegrown authentication is working out alright for our needs since we are still small and only have one service.
* **Year 1: Going native** Lots of people have signed up and outlook is great! People love our service. We are launching native Android and iOS mobile apps as well as desktop apps for Windows and MacOS, and we need to implement login for all of them.
* **Year 1.5: APIs** We're now developing an API so that we can better serve our customer base of developers who want to be able to integrate our service with third parties, but...
* **Year 2: Auth for third parties** Authentication has been a huge challenge now that we have an API that requires authorization as well as several apps and third-party integrations. 😧 To address the complexities and issues this is presenting, we're implementing OAuth in order to provide a much more _universal_ authentication and authorization process for our product and APIs.
* **Year 3: SSO** With a universal login approach, we're now able to leverage Single Sign-On. Our customers love this. This was easy with a universal login; instead of having to change every single service, we only had to do it once! It's much easier to maintain and enhance.
* **Year 4: Multi-factor Authentication** Our users demand more security, so we're adding Multi-factor Authentication. We can do this for all our apps at once using universal login!
* **Years 5, 6, etc: Growing and scaling!** We're rolling out new properties and apps at a steady pace. We have a desktop app, a community, chat hosting for repositories, and several other services as well. Securing and authenticating all our new services is a non-issue with universal authentication! 🎉

This is a hypothetical timeline, but many companies have undergone very similar processes over the years, including (in case you haven't already guessed!) [GitHub](https://github.com). Implementing universal login is a long-term investment. Doing so _early_ paves the way for growth, development, maintainability, and new feature integration far into the future.

<include src="TweetQuote" quoteText="Universal login is a long-term investment. Implementing early paves the way for growth and new feature integration far into the future."/>

## <span id="why-use-universal-login"></span>Why Universal Login is Best Practice

Universal login has many advantages over an embedded login approach, including better security, single sign-on benefits, simpler maintainability, modern user experience, and more. Let's explore these in more detail.

<include src="TweetQuote" quoteText="Universal login provides security, SSO, maintainability, best practice native app implementation, and more."/>

### Security

Universal login is more secure than embedded login. Authentication takes place over the same domain, eliminating cross-origin requests. Cross-origin authentication is inherently more dangerous. Collecting user credentials in an application served from one origin and then sending them to another origin can present certain security vulnerabilities. [Phishing attacks](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) are more likely, as are [bucket brigade attacks](https://auth0.com/docs/security/common-threats#man-in-the-middle-mitm-attacks), also known as man-in-the-middle (MITM) attacks. Universal login does not send information between origins, thereby negating cross-origin concerns.

Embedded user agents are unsafe for third parties, including the authorization server itself. If an embedded login is used, the app has access to both the authorization grant and the user's authentication credentials. As a consequence, this data is left vulnerable to recording or malicious use. Even if the app is trusted, allowing it to access the authorization grant as well as the user's _full_ credentials is unnecessary. This violates the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) and increases the potential for attack.

### Single Sign-On

Universal login orchestrates [single sign-on](https://auth0.com/docs/sso/current) (SSO) between multiple apps while providing cookies from the same origin. Once a user has logged in using a universal login, a cookie is created and stored. Any future calls to the authentication provider's authorization endpoint will then check the cookie. If the user has already signed on, the login page will not be shown again and the user will be logged in via SSO. On the other hand, embedded user agents don't share authentication state, meaning that they cannot be used for SSO.

![universal login with Google](https://images.ctfassets.net/23aumh6u8s0i/1YugCWp0Ra98EeeupBfBqN/7fadfd6f1334f1d3dfb5a5a17cd21a0d/google-login)

### Easier to Implement and Maintain

Universal login is easier to implement as well as maintain for app developers. Cross-origin authentication is inherently more dangerous, but universal login mitigates this risk entirely. Developers do not need to manage the dangers of cross-origin attack vectors if they use universal login instead of embedded login. A universal login page is also already fully implemented, negating the need for the developer to build out their own embedded login UI. The authorization server providing the universal login page can also ensure a consistent and secure experience across all apps that utilize it.

### Best Practice on Native Mobile

The [OAuth 2.0 Best Current Practice for Native Apps RFC](https://www.rfc-editor.org/rfc/rfc8252.txt) requires that _only_ external user agents, such as universal login, should be used for authenticating with OAuth 2.0 in native mobile applications. This is considered best practice for reasons cited above, including security and single sign-on. You can [read more about the OAuth 2.0 BCP for Native Apps here](https://auth0.com/blog/oauth-2-best-practices-for-native-apps/).

![Google login on mobile app](https://images.ctfassets.net/23aumh6u8s0i/3ahqZk6Umj456bBK6MR0en/0b2e534235a83ddbfafcc7ce3b1bab93/google-login-mobile)

<br>

<em>Native mobile apps that use OAuth 2.0 (such as Gmail, YouTube, and others) use the device browser as an external user agent for universal login.</em></p>

### User Experience

Modern users are comfortable with signing in at the authorization provider's universal login page to authenticate (e.g., OAuth with Google, Facebook, GitHub, etc.), in turn gaining the benefits of single sign-on and not being required to repeatedly log into other apps on the same device as long as they are using the same authentication provider.

![universal login with Facebook](https://images.ctfassets.net/23aumh6u8s0i/213AnVULw3nratInY7hOx4/0bb7f7764843aea22f4777c8ba38e55c/facebook-login)

These login pages are on the authorization provider's domain. However, most people don't even notice the redirect because the modern flow of universal login functions so seamlessly. After signing in, they're brought back to the application and are now authenticated. The user experience of universal login is easy and natural, and is the standard expectation for users of modern web and mobile apps. In addition to being more secure, it provides transparency. In doing so, the user is assured that they are securely logging in with a trusted and familiar entity.

![universal login with GitHub](https://images.ctfassets.net/23aumh6u8s0i/51Aq6EuG8BElVcD2RL14W2/aebce1638b1fce4f73a11dadd77349a4/github-login)

## Conclusion

Universal login is the most secure and maintainable standards-based approach to logging in with an authentication provider. Unlike embedded login, it is safer from cross-origin attack vectors and poses no danger to the authorization server. Universal login is the [best current practice for native mobile apps](https://auth0.com/blog/oauth-2-best-practices-for-native-apps/), and OAuth providers like [Google no longer support embedded login strategies](https://auth0.com/blog/google-blocks-oauth-requests-from-embedded-browsers/). It also provides a comfortable and consistent user experience that confers the benefits of SSO.

<include src="TweetQuote" quoteText="Universal login is safer from cross-origin attack vectors and poses no danger to the authorization server."/>

In keeping with app modernization and current best practices, [Auth0](https://auth0.com) provides a robust [universal login](https://auth0.com/docs/hosted-pages/login) solution with integrations for dozens of [social identity providers](https://auth0.com/docs/identityproviders#social), [enterprise identity providers](https://auth0.com/docs/identityproviders#enterprise), custom [OAuth 2.0 integrations](https://auth0.com/docs/protocols/oauth2), [username/password databases](https://auth0.com/docs/connections#database-and-custom-connections), features like [passwordless authentication](https://auth0.com/passwordless) (with SMS or email), and more.

With Auth0, the universal login page is a [fully customizable UI](https://auth0.com/docs/hosted-pages/login#3-customization). In addition, Auth0's [CNAME](https://en.wikipedia.org/wiki/CNAME_record) functionality to persist the same domain across the universal login page and the app is scheduled to launch before the end of 2017.

![Auth0 universal login page](https://images.ctfassets.net/23aumh6u8s0i/6TwsXjuNeMnkg5I4ZN3y5o/c4b1c77a6e5b8e10b44dc000bde49d19/auth0-centralized-login)

You can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a> to try out these features and more to modernize your app's authentication and follow standards-based best practices.


Authentication Provider Best Practices: Universal Login

8f9f6a577da77a9add9cadbb90e66b75

Matthew Machuga

Give your users a choice to link their accounts when accidentally using another provider with the same email address.

# An Easy Way for Users to Link Accounts

A few months ago, Diego Poza wrote an article on [The 3 Best Ways To Create the Single Vision of A Customer](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/).
In it he said the number one must-have is Centralized Identity Management. He 
described that in Auth0, if a user signed in with their Facebook login, then 
their Google account next, they would have two accounts. Auth0 already
provides rules for allowing these accounts to be linked back together 
automatically, but we're happy to announce a new option that gives the
user a choice as to whether they'd like to link the accounts or not.

This happens as part of our [Account Link extension](https://auth0.com/docs/extensions/account-link). It's extremely simple to
set up and can save your users a lot of hassle.

Let's walk through how this gets presented to your users to demonstrate how the
functionality is helpful. Let's say one of your users has the email address
`spencer@example.com`. They've used this email address to sign up for Facebook,
Twitter, Google Apps, and your site. If your site offers all of these social
sign in options and database users, it can be understandably hard for a user
to remember what account they used to sign up for your site. Like in our
example above, we'll assume that `spencer@example.com` signed up with their
Facebook account originally, but now that they're back on the site they can't
remember. They incorrectly guess they used Google to sign in.

With the extension enabled, instead of being taken to your site with a new
account, they are sent to a prompt from the extension, notifying them that they
appear to already have an account registered with that email address on your
site. The most prominent option is to continue linking the accounts. When
**Continue** is clicked, the user will be redirected to log in with the account
that's already detected on your site. Assuming their authentication is
successful, they'll be redirected to your site successfully as their original
account, with the new account merged in as an identity of the original. This
then, conveniently, lets them sign in with either option to the same account.

![Image of extension page](https://images.ctfassets.net/23aumh6u8s0i/6Nd5KcxDJODJ2YK6BIyTtz/1139afaea432a35a18428b1512865a50/hosted-page-example)


But let's assume the opposite for a moment: that your user has intentionally
tried to create a second account with a different provider. Not a problem! They
can simply click the small, diminished link saying, "I want to skip this and
create a new account." and they'll continue to your site logged in as a
new user under their new provider.

Providing the ability to link accounts through the Account Link extension
makes it so your user retains a choice as to whether they'd like their accounts
linked, but will encourage them to link by default since it tends to be the 
most common intent.

You can install it from the [Extensions Gallery](https://manage.auth0.com/#extensions)
and give your users a choice that will make their experience, and your management, easier.

# Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

An Easy Way for Users to Link Accounts

How our Customer's Users Are Connecting To Enterprise Providers



Auth0 supports authentication through a ton of different providers. Through social login, our user's users can connect via Google, Twitter, Facebook and a host of others. Auth0 also provides authentication for Enterprise clients through LDAP, Microsoft, and Google among others.

Throughout 2015 we collected data on how companies and individuals were using these providers with Auth0. We wanted to know how our users were using Auth0 and how their users were using Auth0. Which providers were the most used and how was their share changing over time.

In this second article we are looking at which Enterprise providers are most used via Auth0, how often Enterprise connections are used, and how developers can use better connections to boost security, usability and value for users.

Here’s what we found.

## What Connections Are Enterprise Using?

Auth0 has a number of Enterprise connections available to users easily from the Dashboard:

![Enterprise Connections Dashboard](https://images.ctfassets.net/23aumh6u8s0i/hEuAtmCAEiIzMbYWKGhYd/c5fc389dd6688eaaa7b5a7f85e6557ec/enterprise-connections-dashboard)

Using these allows companies to let their users connect via enterprise credentials, access internal identity providers to validate these credentials, and implement single sign on (SSO) easily for their users.

We wanted to see which of these possible connections was most common among Enterprise users:

![Enterprise Connections Usage](https://images.ctfassets.net/23aumh6u8s0i/7wAwvvsRcIH69tar3IznBp/f2b04932dce902a23a34fd026b285b6b/enterprise-connections)

**Findings:**

* Most (53%) Enterprise connections are through Active Directory Federation Services (ADFS).
* Another 35% are using Active Directory connections.
* SAMLP (7%), Microsoft Azure Active Directory (3%), and Google Apps (2%) round out the top 5.

These results show that logins via Windows Server architecture are still by far the most common connections made by Enterprise. These results tally with what we have said before—[hundreds of thousands of companies rely on Active Directory](https://auth0.com/blog/2013/04/10/Auth0-Windows-Azure-Active-Directory/). In fact, over 90% of all Enterprise connections through Auth0 are built on Windows architecture, either through AD directly, Microsoft Azure, or via Office 365 or Sharepoint.


<include src="TweetQuote" quoteText="Over 90 percent of all Enterprise connections through Auth0 are built on Windows architecture."/>


ADFS is the part of Active Directory Services that allows for resource access across traditional boundaries:

* It provides [simplified and secure identity federation](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/).
* It enables the creation of trust relationships between two organizations.
* Provides access to applications between organizations.
* Provides single sign on between two different directories for web-based applications.

In this way, it acts as an easy and transparent way for a user in one organization to connect and access applications from another organization.

However, because Active Directory was designed to work on the internal corporate network, it isn’t best-suited for web-based services.

### Why People Use Microsoft Azure Active Directory through Auth0?
One of the perks of using Auth0 with Microsoft Azure Active Directory is that you gain access to more features not available in AAD standalone. By combining AAD with Auth0 you can take advantage of all our available SDKs and a better development experience.

Whether you are just getting started or already deep into a project - our SDKs will help you quickly integrate a solid authentication framework into your application. We provide SDKs for most major languages and frameworks including [Angular](https://auth0.com/docs/quickstart/spa/angularjs), [Node.js](https://github.com/auth0/node-auth0), [ASP.NET](https://github.com/auth0/auth0.net), [Java](https://auth0.com/docs/java-overview), and more. Our selection of quickstarts, seed projects, and tutorials showcase best practices and how-to’s to ensure you are up and running as quickly as possible.

You also get access to rules, which are JavaScript code snippets that allow easy control and customization of the login process. Rules are an easy way to address that inevitable exception in an identity environment – integration with marketing or analytics tools, whitelisting and other forms of access control, triggering a webhook, and so on. You can check the [Rules documentation](https://auth0.com/docs/rules) for more information.

## How Much Are Enterprise Connections Used?

Enterprise connections are only a small part of the possible login options available through Auth0. We wanted to see what proportion of the total logins were Enterprise compared to these other options:

![Total Users per Connection Type](https://images.ctfassets.net/23aumh6u8s0i/4jXEa8UQMFyNvlzzUYAewi/5fd14be2dbe5a03910f25f95f8c3c667/total-users)

**Findings:**

* An astonishing 70% of all logins still use username and password combinations.
* Enterprise connections account for almost a quarter (24.7%) of all logins.
* Passwordless logins currently account for less than 1% of all logins.

So 1 in 4 connections made through Auth0 are using an Enterprise connection. From this we can surmise that a significant number of Auth0 users are B2B companies, looking to make it easier for the employees of other companies to use their apps.

This is excellent news. One of the best ways for developers to [grow their revenue](https://auth0.com/blog/2015/08/18/how-to-go-upmarket-and-grow-your-revenue-by-20x) is to add Enterprise options to their existing app, such as the ability for companies to login with their current Enterprise connections.

What is less excellent news is that Enterprise connections, as well as social and passwordless, are still dwarfed by the traditional username and password combination. This means lower security, reduced compliance, and reduced B2B collaboration for those companies and users.

## Conclusion

There are two major findings from our study so far:

1. The vast majority of Enterprise connections are using Windows Active Directory in some capacity.
2. The vast majority of users are still using an individual username and password combination.

Both of these are areas of improvement. Auth0 users currently connecting through AD or ADFS could start to look seriously at using Azure for their connections instead. And Auth0 users not pushing their own users away from unique usernames and passwords should definitely consider allowing SSO, either through Enterprise or Social.

[Learn how to evaluate a modern identity management solution that fits your needs in this free eBook, Build vs Buy: Guide to Evaluating IAM.](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/)


Analyzing Enterprise Connections Data: What can we learn?

Learn how to implement social logins on Android with Facebook, Google, Twitter and Instagram as providers

"provider"