When the Norwegian government made the decision to centralize all ticketing and travel planning for the country’s public transportation services, Entur was founded to manage and develop the systems necessary for doing so.

As a government-owned private company, their first task was to centralize their ticketing system for the nation’s rail system. To accomplish this (and ensure it would scale to other public infrastructure later), Entur needed a fresh approach to authentication in order for travelers to be able to book.

“We wanted to build a system that gave travelers the ability to plan a trip from the north of Norway to the south of Norway and purchase all of the tickets for the entire journey in one place,” Tor Magnus Castberg, Entur’s Platform Team Lead, explains. “We looked at the systems and requirements we had and decided it would be best to develop everything, more or less, from scratch.”

Complex Security Requirements Lead Entur To External Identity Solutions

While Entur’s new ticketing system was ultimately intended for end users, their business partners also needed access to the system, and each had a different set of technical and security requirements.

“For example, transportation operators need the ability to create new products and timetables within our system. But other companies like ticketing kiosk chains need to access this information to sell tickets to travelers,” Castberg explains.

The solution also had to be GDPR-compliant. Given the complex needs the ticketing system had to fulfill, Entur decided to seek out an external identity solution rather than build a system in-house. “Authentication is hard. There are so many things that can go wrong,” Castberg says. “Since we’re not an identity or security company, we decided to look for experts who could handle authentication for us rather than do it ourselves.”

Entur Solves Every Use Case in 2 Months With Auth0

Entur knew whatever identity solution they selected had to be API-driven in order for it to scale effectively. They also needed a solution with a roadmap they could trust, which led them to Auth0. 

“We needed to know that the solution we chose could provide industry-standard authentication as a service. But we also needed to know that it had a future,” Castberg explains. “Auth0 was the best solution for us in that respect.”

Just two months later, Entur completed their integration of Auth0’s platform for each use case they needed to address:

• B2C: Entur built a library of code on top of Auth0’s software development kit (SDK) that makes it easy for their developers to scale end-user account creation and login for ticket purchasing and travel planning.

• B2B: When Entur brings a new partner or operator onboard, Auth0 handles the federation of that operator’s users for them. “There's no creation of a new user within our system in the traditional sense. We just federate to them using Auth0's active directory, and then they handle their own users themselves,” Castberg says. A quarter of Entur’s 85 partners are currently federated, with more adopting the approach in the coming months.

• M2M: Entur uses Auth0’s machine-to-machine services to ensure each service in their system can talk to each other securely. “For example, if a user does a travel search from A to B, the traveler algorithm will return suggestions to their phone. Then their phone will request the prices from our office service, which then will do a lookup in the product service and return the price,” Castberg explains.

Industry-Leading Authentication Without Technical Debt

Partnering with Auth0 provided Entur with best-in-class authentication without requiring them to hire dedicated resources to build and maintain their own system. 

“We couldn't replicate Auth0,” Castberg explains. “The closest thing we could do is run some kind of third-party software on-premise. But we would need at least two FTEs just for managing that system and then additional personnel for improving it. Instead, Auth0 takes care of everything without us even noticing.”

As Entur continues to centralize ticketing and travel planning for other public transportation services, the team trusts that Auth0 will be there to support them. “I'm quite sensitive to vendor behavior. But Auth0 really cares about how we're doing, and it shows,” Castberg says.