Auth0

The Corma and Auth0 integration keeps the people who administer your Auth0 tenants in line with your engineering and security teams. Auth0 describes itself as a flexible, drop-in solution to add authentication and authorization services to your applications, and Okta completed its acquisition of Auth0 in May 2021, saying Auth0 would operate as an independent business unit. Auth0 plans are sized by monthly active end users, so the governance question is who can change the tenant that signs your customers in.

Key takeaways

• Auth0 documents ten Dashboard tenant member roles, including Admin, five Editor roles and two Viewer roles.
• Auth0 Dashboard SSO is included only on the Enterprise plan and is set up through Auth0 Support.
• Auth0 tenant member invitations cannot be automated through the Management API, and tenant member access cannot follow IdP group memberships.
• Auth0 Management API access tokens last 24 hours by default, and once issued they cannot be revoked.

Who can change an Auth0 tenant?

A tenant administrator adds each member by email from Dashboard > Settings > Tenant Members and picks one or more roles; the invitee then logs in with a social provider or with an email and password. Auth0's Dashboard SSO documentation warns that adding the SSO connection does not stop members from logging in with their existing methods, such as email and password, GitHub or Google, and that a member invited under another identity can still use it. Each member can self-enroll in MFA, but MFA cannot be enforced for all members of a tenant.

Machine credentials need the same attention. Machine-to-machine applications are granted an API's scopes, and Auth0 warns that the create:client_grants and update:client_grants scopes let a client grant further permissions to itself. An application has a single client secret. Auth0 itself recommends reviewing tenant members periodically, checking that former employees no longer have access and that there is more than one Dashboard admin.

How Corma governs Auth0

• Tenant members under review: Admin and Editor roles go into automated access reviews, in line with Auth0's own advice to confirm each member's need.
• Leavers removed from every tenant: a leaver workflow in the IT Workflow Builder asks a tenant administrator to remove the person under Tenant Members in each tenant, or from Auth0 Teams, which removes them from all team tenants at once.
• M2M apps with an owner: machine-to-machine apps and their client secrets are non-human identities, so each one needs a named owner, starting with apps that hold client_grants scopes.
• Plan in view: the Auth0 plan and its renewal date sit in SaaS subscription management with the rest of your stack.

Frequently asked questions

Does Auth0 support SSO and SCIM for Dashboard access?

Dashboard SSO requires an Enterprise plan and is configured with Auth0 Support, with documented setups for ADFS, Azure AD, Google, Okta, OneLogin and generic OIDC or SAML providers. Auth0 documents no SCIM provisioning for tenant members, while Auth0 Teams offers just-in-time provisioning as Early Access for Public Cloud Enterprise tenants. Read what just-in-time provisioning covers.

How does Corma connect to Auth0?

Tenant member invitations cannot be automated with the Auth0 Management API, so Corma's browser-based agents handle member steps in the Auth0 Dashboard, in an isolated browser session with credentials taken from your password vault. See also how Corma covers Okta.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know who can still change your Auth0 tenants? Book a Corma demo.