Custom Organization Development

You can extend Auth0 capabilities using organization metadata and rules, or use our APIs and SDKs to build organization administration dashboards for your users.

Extensibility

Organizations supports our extensibility points, so you can define properties within organization metadata and expose that data to rules. This allows you to customize capabilities for individual customers; for example, you can execute custom logic in Rules for certain customers based on their subscription plan by storing that information in organization metadata.

Rules context object

The rules context object stores contextual information about the current authentication transaction, such as the user's IP address, application, or location.

If you change token content using the context object within a rule, your changes will be available in tokens after all rules have finished running. If your application also requires multi-factor authentication (MFA) or user consent, the user will be prompted before changes in the token are available.

Actions event object

The Action event object stores contextual information about the current authentication transaction, such as the user's IP address, application, or location.

If you change token content using the event object within an Action, your changes will be available in tokens after all Actions have finished running.

SDKs

To allow members to self-manage their organizations, you can assign roles to members, and use our API and SDKs to build dashboards in your products. Administrators can configure Single Sign-On (SSO), invite users to organizations, assign members to organizations, assign roles to members, and so on.

Some example tasks you may want to perform with organizations using the SDKs are as follows:

I want users to log in to a specified organization

When defining a new client, pass the organization ID into an organization parameter. Then on callback, ensure that the organization returned in the ID token is the same one that was sent in the /authorize request by validating the org_id claim in the same way that other claims like exp and nonce are validated.

To learn more, read:

From my application, I want to get the organization to which the authenticated user logged in

If the user was authenticated using an organization, the organization ID will appear in the org_id claim in the ID token. Using the Auth0 SPA SDK, this can be retrieved as follows:

``` const { org_id } = await client.getIdTokenClaims(); ```

From my API, I want to get the organization with which the access token was issued

If the user was authenticated using an organization and an audience was specified, the access token will be a JWT and will contain the org_id claim with the ID of the organization to which the user logged in.

This can be validated along with the other claims on the backend, as in the following example for Ruby:

class JsonWebToken
  def self.verify(token)
    decoded = JWT.decode(token, nil,
               true, # Verify the signature of this token
               algorithms: 'RS256',
               iss: 'https://YOUR_DOMAIN/',
               verify_iss: true,
               aud: Rails.application.secrets.auth0_api_audience,
               verify_aud: true) do |header|
      jwks_hash[header['kid']]
    end

    // Retrieve the organization ID value from the decoded token
    org = decoded[0]['org_id']
  end
end

Find Your Auth0 Domain

If your Auth0 domain is your tenant name, your regional subdomain (unless your tenant is in the US region and was created before June 2020), plus .auth0.com. For example, if your tenant name were travel0, your Auth0 domain name would be travel0.us.auth0.com. (If your tenant were in the US and created before June 2020, then your domain name would be https://travel0.auth0.com.)

If you are using custom domains, this should be your custom domain name.

Learn more