andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

With .NET 9.0, some interesting authentication and authorization features have been added to the platform. Let’s take an overview of them.

.NET 9 introduces interesting new features, primarily focused on cloud-native development and performance. However, the [list of improvements](https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-9/overview) in other areas of the platform is long. This article will focus on the main innovations introduced by .NET 9.0 in authentication and authorization.

## Support for Pushed Authorization Requests (PAR)

One of the most interesting features brought by .NET 9.0 is support for [Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) (PAR), an OAuth 2.0 and OpenID Connect extension that strengthens the security profile of these protocols. PAR allows applications to not expose the parameters of an authorization request through the browser. Instead, it enables direct communication of these parameters between the application and the authorization server. This is very important when you implement applications in a high-security context, such as in the financial, healthcare, or other regulated sectors. If you want to learn the details of [how PAR works, read this article](https://auth0.com/blog/what-are-oauth-push-authorization-requests-par).

ASP.NET Core adds support for PAR to the native [OpenID Connect middleware](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnecthandler). This is a typical configuration of the middleware if you are not using the [Auth0 SDK](https://github.com/auth0/auth0-aspnetcore-authentication):

```csharp
// Program.cs
...
  
builder.services.AddAuthentication(options =>
  {
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
  })
  .AddCookie()
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";

    options.ClientId = builder.Configuration["Auth0:ClientId"];
    options.ClientSecret = builder.Configuration["Auth0:ClientSecret"];
    options.ResponseType = "code";
});

...
```

If the Identity provider you are using supports PAR, you don't need to do anything different from this. In fact, the OpenID Connect middleware transparently supports PAR by default. In other words, if the middleware detects PAR support by analyzing the standard `.well-known/openid-configuration` discovery document, it automatically leverages the PAR endpoint to pass the authorization request parameters. You can change the default behavior by modifying the value of the new option property `PushedAuthorizationBehavior`. For example, the following setting disables PAR support:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}";
    ...
    options.ResponseType = "code";
    
    options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable;
});

...
```

If you want to force your application to use PAR, you can set the value of `PushedAuthorizationBehavior` to `PushedAuthorizationBehavior.Require`. In this case, you get an error if the Identity provider does not support PAR.

Finally, to help customize PAR support, the [`OnPushAuthorization`](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectevents.onpushauthorization?view=aspnetcore-9.0#microsoft-aspnetcore-authentication-openidconnect-openidconnectevents-onpushauthorization) event has been added to `OpenIdConnectEvents`.

## OAuth and OIDC Parameters Customization

Staying in the context of the OpenID Connect middleware, now you have a simplified way to add custom parameters to the authorization request. Up to .NET 8, if you wanted to add a custom parameter, such as `audience`, to the authorization request, you had to handle the `OnRedirectToIdentityProvider` event as shown in the following code snippet:

```csharp
// Program.cs
...

.AddOpenIdConnect(options =>
{
  options.Events.OnRedirectToIdentityProvider = context =>
  {
    context.ProtocolMessage.SetParameter("audience", "https://myapi.com");
    return Task.CompletedTask;
  };
});
...
```

> If you are using the [Auth0 SDK for ASP.NET Core](https://github.com/auth0/auth0-aspnetcore-authentication), you already have [an easier way to add the audience parameter](https://github.com/auth0/auth0-aspnetcore-authentication/blob/main/EXAMPLES.md#calling-an-api).

.NET 9 introduces the `AdditionalAuthorizationParameters` option to simplify this process. The previous code is equivalent to the following:

```csharp
// Program.cs
...
  
  .AddOpenIdConnect("Auth0", options =>
  {
    ...
    
    options.AdditionalAuthorizationParameters.Add("audience", "https://myapi.com");
});

...
```

## Configuration Flags for Windows Authentication

When using [HTTP.sys](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys) as a web server for ASP.NET Core applications on Windows systems, you can now configure [Windows Authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth) by setting two new properties:

- `EnableKerberosCredentialCaching`. If this boolean value is `true`, the Kerberos authentication credentials are cached.
- `CaptureCredentials`. If this boolean value is `true`, the HTTP Server API captures the caller's credentials and uses them for Kerberos or Negotiate authentication.

The following code shows an example of usage of these properties:

```csharp
// Program.cs
...
builder.UseHttpSys(options =>
{
    options.Authentication.Schemes = AuthenticationSchemes.Negotiate;
    options.Authentication.EnableKerberosCredentialCaching = true;
    options.Authentication.CaptureCredentials = true;
});
...
```

## Authentication State Serialization for Blazor Web Apps

If you are a Blazor developer, you know how complicated authentication is since [render modes](https://www.telerik.com/blogs/getting-started-blazor-new-render-modes-net-8) have been introduced in .NET 8. You can get an idea by reading [this excerpt](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Why-Is-Blazor-Authentication-More-Complicated-Now) from my tutorial on adding authentication to Blazor Web Apps. Basically, in an application model where components can be rendered on the server side, on the client side, and on both sides dynamically, you need to keep the user authentication state in sync between the two sides of your Blazor application. This leads to writing a fair amount of code, as you can see by taking a look [here](https://auth0.com/blog/auth0-authentication-blazor-web-apps/#Syncing-the-Authentication-State). In practice, you need to serialize the user authentication state on the server, then send it to the WebAssembly client, which in turn needs to deserialize it. In addition, both authentication states must be kept in sync in order to reflect on the client side the actual authentication state on the server.

Fortunately, .NET 9 simplifies this approach by providing two new methods:

- `AddAuthenticationStateSerialization()`, which adds the services to serialize the authentication state on the server.
- `AddAuthenticationStateDeserialization()`, which adds the services to deserialize the authentication state in the WebAssembly client.

Instead of creating the serializing and deserializing classes yourself, you can now simply call the two methods respectively on the server and on the client to sync the authentication state.

On the server, you will have:

```csharp
// Program.cs
...
builder.Services.AddRazorComponents()
    .AddInteractiveWebAssemblyComponents()
    .AddAuthenticationStateSerialization();
...
```

On the client, you will write the following:

```csharp
// Program.cs
...
builder.Services.AddAuthorizationCore();
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddAuthenticationStateDeserialization();
...
```

Read the [documentation](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/?view=aspnetcore-9.0&tabs=visual-studio#manage-authentication-state-in-blazor-web-apps) to learn more.

## Conclusion

Although they are not revolutionary innovations in authentication and authorization, these new features are very convenient because they aim to simplify the work of .NET developers.
In particular, PAR support prevents developers from implementing the extension specifications themselves and encourages the adoption of increasingly advanced security. Also, simplifying the serialization and deserialization of the authentication state in Blazor relieves developers of the burden of implementing specific classes, resulting in potentially fewer bugs.

Authentication and Authorization Enhancements in .NET 9.0

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

emma-gray

Sr. Manager, Product-Led Growth Marketing

Emma Gray

Get started fast with two best-in-class developer platforms: Auth0 and Vercel

**TL;DR:** [New Auth0 Integration](https://vercel.com/integrations/auth0) for Vercel: Available Now. We’ll share why we partnered with Vercel, help guide you through deploying an application, and explain how you can take full advantage of this integration.

<AmpContent>
<amp-youtube
 data-videoid="YqGClksfZKE"
 layout="responsive"
 width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/YqGClksfZKE' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Why Should I Choose Auth0?

Auth0 provides an extensible and scalable authentication experience, allowing you to focus on your core product. We’ll ensure your users have the best possible experience and help you maintain a strategic advantage for years to come.

We offer comprehensive out-of-the-box functionalities with cutting-edge technologies and architecture. Our rich features include customizable actions, connections to over 60+ social and Identity providers, broad support for open standards (OIDC, SAML, FIDO, OAuth, and more), multi-cloud encryption architecture, extensive compliance and regulatory requirements, and easily customizable sign-up and login interfaces and flows, to name a few. 
 
## What Is Vercel and Why Did We Choose to Partner with Them?

[Vercel](http://vercel.com/) is a cloud platform designed to simplify the deployment process for web applications, making it easy to deploy and manage your frontend. In the world of web development, efficiency and speed are crucial, as are the safety and security of production environments. Integrating with a third-party platform like Auth0 allows Vercel users hosting their new or existing projects to seamlessly extend Vercel’s capabilities.

Prioritizing who we partner with comes down to selecting organizations who align with our mission and values, including key pillars of cutting-edge developer experiences and a foundation of security. With this in mind, investing in a partnership with Vercel was an obvious choice for our team. This integration allows you to build scalable, secure, and compliant applications with an enhanced user experience by leveraging the strengths of these two best-in-class platforms. 

## Let’s Start Building with Auth0 and Vercel

**Challenge**: You’re looking for the most efficient way to integrate Auth0 into your Vercel-powered app.

**Solution**: Use the new integration to build and customize the Identity flow for your Vercel project. To get your app up and running quickly and securely, this integration will:

* Set up a production environment in Vercel that integrates with your Auth0 tenant in just a few clicks,
* Automatically create an [Application](https://auth0.com/docs/get-started/auth0-overview/create-applications) in your Auth0 tenant that is connected to your Vercel project, and 
* Pre-load your [Auth0 application credentials](https://auth0.com/docs/secure/application-credentials) into Vercel, allowing you to skip some of the manual steps in this credentials setup.

To get started, you will need a [project in Vercel](https://vercel.com/docs/projects/overview). You can either import your own project into Vercel or use a Vercel template so you don’t have to start from scratch. For this demo, we’re going to use a simple [B2B SaaS app template](https://vercel.com/templates/next.js/auth0-nextjs-saas-starter) (learn more [here](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/)). Before starting, you'll want to make sure to deploy the template in Vercel.

### Add the integration to your project

_The following steps are based on an example flow. Refer to [docs](https://a0.to/auth0-vercel-docs) for more information._

1. Open the [Auth0 integration](https://vercel.com/integrations/auth0) in Vercel.
2. Select a Vercel team and the Vercel project that this integration will have access to. _Note: At this time, the integration is limited to one project per Vercel team._
3. Click Install.

![integration](https://images.ctfassets.net/23aumh6u8s0i/14eBngE6fGo3LLYmsazyej/fef2739f60c10d8e4621820cd1c6d53e/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

4. Log into Auth0 and select the Auth0 tenant you would like to use.

![integration](https://images.ctfassets.net/23aumh6u8s0i/2NeRwaR38HOAJp0CMRSULh/05375ed30bcb3404effd26bfd07a3b16/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

5. Click Accept.
6. Select and confirm the Vercel project that you would like to integrate with Auth0. This will create an Application in your Auth0 tenant with the same name, which you can find at [Auth0 Dashboard > Applications](https://manage.auth0.com/#/applications).

![Vercel](https://images.ctfassets.net/23aumh6u8s0i/6fBKpsGXChFuoVC03SDnmH/5727eea8b7d271548da59c1f35f834a1/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

It’s that simple! You can confirm by navigating to your project’s “Environment Variables” within Vercel (Select project > Settings > Environment Variables), where you will find your [Auth0 application credentials](https://auth0.com/docs/secure/application-credentials).

> If you have any technical questions, refer to [our documentation](https://a0.to/auth0-vercel-docs).

<div class="alert alert-info alert-icon">
 
 NOTE: 
 As of 7/18/2024, this integration only works with production environment Vercel projects and only supports Next.js apps using the latest version of the Auth0 SDK. 
</div>

### It’s time to start leveraging all of Auth0’s capabilities

Any changes we make to our Application within Auth0 will be reflected in the identity flow of our Vercel project and vice versa. For example, let’s create an [Organization](https://auth0.com/docs/manage-users/organizations) in the B2B app we deployed earlier.

![Auth0](https://images.ctfassets.net/23aumh6u8s0i/5LENP3xOgPvQeLxcSNT4Qv/0584f5239dfb2247764a60f27a35bfff/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

This Organization automatically appears in our Auth0 tenant, and we can customize its settings and branding within Auth0. Let’s add a logo!

![Auth0](https://images.ctfassets.net/23aumh6u8s0i/1gdO1eHhlfdkYEK51Kzmzn/08dc06a7e809f9501939ee22252f7b24/Uploaded_from_New_Auth0_Integration_for_Vercel__Available_Now)

## Have Questions? 

**We want to hear from you! Join our AMA on Aug 8, 2024**

Deploying your app quickly and securely with Auth0 and Vercel just became easier and faster. This is the first version of this integration, and we’re always looking for ways to improve. Join us for an online Ask Me Anything event in the Auth0 Community on August 8. This is your chance to share your questions, feedback, and ideas of what you’d like to see in the future. Engage with our product experts [here](https://community.auth0.com/t/auth0-community-ask-me-anything-integrating-auth0-within-the-vercel-marketplace/136388).

Happy authenticating!

New Auth0 Integration for Vercel: Available Now

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Your identity platform is critical to growing and scaling your SaaS application. Accelerate business growth and keep your users secured with Auth0 by Okta

For today’s SaaS builders, the pressure to rapidly innovate and seamlessly scale can be intense.

Evolving macroeconomic pressures mean companies building SaaS applications need to do more with less. And every B2C innovation amps SaaS customer expectations. AI has further transformed the competitive landscape, presenting both an opportunity for product differentiation and a threat. [There’s just more that attackers can do now](https://www.securitymagazine.com/articles/99832-study-finds-increase-in-cybersecurity-attacks-fueled-by-generative-ai) — and they can do it faster. 

SaaS companies also need to do more — and they need to see speed and security gains just so customers can keep up with the rate of change. And honestly, they need to deliver more than what’s expected in order to stay relevant in this fast-paced society. 

Since SaaS is in this ever-evolving space, companies must keep up at the business level to stay ahead of their competition. In turn, developers must continuously learn new back-end methods to keep up with the new SaaS technologies.

Let us show you how Auth0 by Okta keeps up and makes your life easier.

## How Auth0 by Okta can help your SaaS

Robust identity management is crucial for ensuring seamless user experiences, maintaining data security, and complying with regulatory requirements. Auth0, the leading identity and access management (IDaaS) platform, stands out as the ideal solution for SaaS applications due to its comprehensive features, ease of use, and robust security measures.

Auth0 simplifies the authentication and authorization process for SaaS applications, enabling developers to focus on building core functionalities rather than building their own identity solutions and managing identity infrastructure.

[Universal Login](https://auth0.com/features/universal-login) provides a centralized and unified login experience for users across all your applications, supporting a wide range of authentication flows, devices, and screen sizes. Universal Login enhances user experience and simplifies the integration process for developers. With Universal Login, users can sign in using [passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) or use their existing credentials from social media platforms, enterprise directories, or email addresses, eliminating the need to create separate accounts for each application.

In addition to Universal Login, Auth0 provides a comprehensive set of SDKs for various programming languages and frameworks, making it easy for developers to integrate Auth0 into their applications. These SDKs handle everyday authentication tasks, such as login forms and password resets, ensuring consistent and secure user experiences across applications. For more customized scenarios, Auth0's powerful APIs provide granular control over authentication and authorization flows, allowing developers to tailor them to specific requirements and integrate seamlessly with third-party services.

**Here are some specific benefits of using Auth0 for SaaS applications:**

* **Streamlined user onboarding**: Universal Login eliminates the need for users to create separate accounts for each application, making it easier for them to get started.
* **Improved user experience**: A seamless and consistent login experience across all applications enhances user satisfaction and reduces friction.
* **Customizability**: The Universal Login page can be customized to match your brand and needs. At the same time, [Auth0 Actions](https://auth0.com/features/actions) enable developers to extend Auth0 beyond its core functionality and incorporate custom logic such as integrations with APIs (CRMs, billing, email automation, marketing tools, etc) or write custom policies into the authentication and authorization flows.
* **Reduced development time**: Developers can save time and effort using pre-built Universal Login components and SDKs, simplifying the integration process.
* **Global or regional scalability**: Auth0's public and private cloud-based infrastructure scale seamlessly to accommodate user demand internationally and fluctuating traffic spikes.
* **Security Center and Log Streaming**: Auth0 provides robust security features to protect your SaaS application users and your business. With Attack protection features such as bot detection and breached password detection, you can offer comprehensive protection against credential-stuffing attacks. You can also offer streamlined security and follow compliance with MFA and RBAC. In addition, you can monitor your applications and detect identity-driven attacks with Security Center and integrate activity logs with your security toolkit with Log Streaming.
* **Expanded support for various platforms**: Universal Login and SDKs are available for various programming languages and frameworks, enabling developers to build secure and scalable SaaS applications across various platforms.
* **Future-Proof Features**: Auth0 continuously invests in innovation, incorporating the latest security and authentication technologies. By integrating with Auth0, SaaS applications can leverage these future-proof features, ensuring they remain secure and compliant with evolving industry standards.

## B2B Ready with Auth0 Organizations

For some SaaS applications, the B2B aspect is baked into the core design, with a clear understanding of the requirements for managing users from different organizations. However, for many SaaS applications, the need to support B2B scenarios may arise as a requirement that needs quick implementation. This can add complexity to development and require significant effort to integrate and maintain separate identity management systems for each organization.

Auth0 addresses this challenge with [Auth0 Organizations](https://auth0.com/organizations) by providing a unified platform for managing B2B relationships, enabling SaaS applications to efficiently onboard, manage, and secure user identities across multiple organizations.

Auth0 customers can use Organizations to:

* Represent their business customers and partners in Auth0 and manage their membership.
* Allow your business customers to securely manage and customize how their end-users access apps, with the ability to add as many organizations as they need to their Customer Identity Cloud (Private Cloud) tenant.
* Configure branded, federated login flows for each business.
* Build administration capabilities into their products, using Organizations APIs, so that those businesses can manage their own organizations.
* Supports your multi-tenant product out-of-the-box, conveniently serving from a single Customer Identity Cloud tenant.

![Organizations](https://images.ctfassets.net/23aumh6u8s0i/kZUAmaE3qFsxXaeTwxeOb/3dbe661afe612b1596fe4e990803d248/saas01.png)

## Enterprise Ready

In the realm of enterprise-grade SaaS applications, the need for comprehensive identity management extends far beyond traditional user authentication. Enterprises demand a robust solution that seamlessly integrates with existing IT infrastructure, manages complex access policies, and complies with stringent security standards.

Auth0 enables SaaS applications to connect seamlessly with enterprise systems without building custom integrations, eliminating the need for developers to maintain multiple integrations and reducing development time and effort by providing:

* **Seamless Integration with Enterprise Identity Systems**: Auth0 Organizations seamlessly integrate with existing [enterprise identity providers](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers), such as Active Directory, LDAP, and SAML IdPs.
* **Single Sign-On (SSO) for Enterprise Applications**: Auth0 Organizations supports SSO for enterprise applications, enabling employees to sign in to multiple applications using a single set of credentials. This streamlines the user experience and improves productivity.
* **Activity Auditing for Enterprise Compliance**: Auth0 provides detailed activity auditing for enterprise compliance, allowing organizations to track user activity and access patterns. This auditing functionality helps to identify suspicious activity, investigate potential security breaches, and ensure compliance with regulatory requirements.

## Built-in Security

With built-in security features and continuous innovation, Auth0 provides developers with the tools and expertise to build secure SaaS applications that safeguard user identities, sensitive data, and applications from a wide range of threats. Auth0's security features are not only beneficial to developers; they are also a key selling point for SaaS providers who want to ensure their customer’s data and applications are safe and secure.

Here are some of the built-in security features of the Auth0 platform:

### Attack Protection

Auth0's attack protection features can detect and stop malicious attempts to access your application by blocking traffic from specific IPs, displaying CAPTCHAs, and more.

Auth0 offers the following attack protection options:

* **[Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection)**: Bots, automated programs often employed by malicious actors performing credential-stuffing attacks, pose a significant threat to online applications and services. Auth0's bot detection capabilities utilize sophisticated techniques to identify and block these bots, preventing them from accessing your applications and disrupting user experiences.
* **[Suspicious IP Throttling](https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling)**: Blocks traffic from any IP address that rapidly attempts too many logins or signups. This helps protect your applications from high-velocity attacks that target multiple accounts.
* **[Brute Force Protection](https://auth0.com/docs/secure/attack-protection/brute-force-protection)**: Brute force attacks involve repeatedly attempting to guess user login credentials, often automated through scripts or botnets. To combat these attacks, Auth0's brute force protection feature limits the number of failed login attempts from a single IP address. Once a threshold of failed attempts is reached, the IP address is temporarily blocked, preventing further attempts and mitigating the risk of successful brute-force attacks.
* **[Breached Password Detection](https://auth0.com/docs/secure/attack-protection/breached-password-detection)**: Auth0 tracks large security breaches that occur on major third-party sites. If Auth0 identifies that any of your users’ credentials were part of a breach, the breached password detection security feature triggers keeping your accounts safe.

![attack protection](https://images.ctfassets.net/23aumh6u8s0i/6T8KTzpEpJ0YrNMX7qDIMM/a93051c4295c9fd66acbb752fcbdaa08/saas02.png)

Auth0's attack protection features are based on industry-standard security protocols, and they can help you protect your applications from a wide range of attack vectors. To implement Auth0's attack protection features, you can integrate Auth0 into your application. Once integrated, Auth0 will automatically protect your application from attacks.

## Extensibility

Auth0 goes beyond providing a robust authentication and authorization platform; it also offers a wide range of extensibility capabilities, enabling developers to tailor the platform to their specific application requirements and integrate it with their existing infrastructure.

### Auth0 Actions

[Auth0 Actions](https://auth0.com/features/actions) is a powerful extension mechanism that empowers developers to modify Auth0's authentication and authorization flows. These JavaScript functions can be executed at various points in the authentication process, allowing developers to:

* **Modify access tokens with custom claims**: Add, update, or remove custom claims to access tokens, enabling granular control over user permissions and data sharing.
* **Integrate with external services**: Connect to external services like CRM systems, customer data platforms, and payment gateways to enrich user profiles and facilitate seamless user journeys.
* **Enhance user experiences**: Personalize the login and registration experience, customize error messages, and provide user context-aware support.
* **Implement custom logic**: Add custom logic to handle specific scenarios, such as verifying two-factor authentication codes or managing user roles.

You can write your own custom Auth0 Actions writing JavaScript code or browse and install any Action from a curated collection at the [Auth0 Marketplace](https://marketplace.auth0.com/). In the marketplace, you can find Actions providing a wide range of functionalities, such as:

* **Social login integrations**: Connect with popular social networks like Facebook, Google, and LinkedIn to facilitate user authentication and signup.
* **Identity Proofing**: Identity proofing allows you to verify a user's real-world identity based on life history (a credit report), biometrics (a facial scan), and other factors before granting access.
* **Compliance and security solutions**: Implement compliance solutions like fraud detection and data privacy controls.

And much more...

## Get Started with Our SaaS Starter Kit

Embarking on developing a SaaS application can be an exciting yet challenging endeavor. To simplify the process and accelerate time to market, Auth0 offers a [SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) that provides a jumpstart for building secure and scalable SaaS applications.

The SaaS Starter Kit is a guide and boilerplate you can use to build a Next.js SaaS application tailored for the following use cases:

* SaaS Multi-tenancy with Auth0 Organizations in a single Auth0 tenant.
* A tiered pricing model using Auth0 Actions and User Profile[ App Metadata](https://auth0.com/docs/manage-users/user-accounts/metadata#metadata-types).
    * Support Trial, Personal, Teams, and Enterprise plans in a SaaS application.
* Trial plan expiration and user conversion using Auth0 Actions.
    * Use Actions to update user profile data, enrich an ID or Access Token with custom claims, or call 3rd-party APIs, such as the Stripe API, to manage user subscription status.
* Self-service SSO for business users using the Auth0 Management API and Enterprise connections with support for OIDC connections.
* Self-service User Management using the Auth0 Management API.

With the [Auth0 SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) as your foundation, you can build secure, scalable, and feature-rich SaaS applications that provide a seamless user experience while adhering to industry best practices for authentication and authorization.

## The Customer Identity Platform for Startups

[Auth0 for Startups](https://auth0.com/startups) is a program that provides the convenience and security of Auth0 by Okta to eligible startup customers FREE for a year, so you can get your SaaS application up and running quickly while keeping your users’ data secure.

Some of the benefits of the program are:

* Up to 100k Monthly Active Users
* Up to 5 Enterprise Connections
* All the B2B features you need to scale your business

> Learn more and apply for the program in[ the customer identity platform for startups](https://auth0.com/startups).

Solving Digital Identity Management for Your SaaS Application

pawan bhardwaj

Pawan is a seasoned business and technology enthusiast who welcomes challenges and pushes boundaries for value creation. In addition to his passion for technology, he also enjoys learning about music, art, architecture, and philosophy as lifelong pursuits.

In his career, he has worked in the domains of product management, solutions architecture, cybersecurity, cloud, telecom, and software engineering. He has led SaaS scaling initiatives in Cybersecurity (IAM), portfolio evolutions to cloud and telecom APIs, and deep partner engagements.

He has an MBA from Sonoma State University and an MS from the University of Delhi.

Principal Product Manager

Pawan Bhardwaj

jc tierney

JC Tierney was born and raised in the suburbs of Chicago, and is a life-long Blackhawks, White Sox and Bears fan.

He graduated from Benet Academy in Lisle, Illinois. He went on to attend the University of Dayton, where he graduated with a degree in Management Information Systems, and loved every minute of the experience.

Director, Engineering

JC Tierney

Efficiency on a robust foundation: Exploring multi-subscriber (Public Cloud) deployment on Auth0's converged platform architecture.

**TL;DR:** Auth0’s SaaS services are available via two modes of cloud deployment:

* Multi-subscriber (shared infrastructure, a.k.a. Public Cloud) 
* Single subscriber (dedicated infrastructure, a.k.a. Private Cloud). 

These offerings now have a converged platform architecture that increases business agility, developer productivity, scalability, reliability, and security by using industry-leading tools and fully automated operations.

This article continues a series of earlier ones focused on Private Cloud deployments. Unlike the single-subscriber Private Cloud, the Public Cloud hosts thousands of subscribers. In multi-subscriber deployments, data isolation, security, and elimination of noisy neighbor problems are paramount.

Public Cloud leverages the converged architecture composed of three tiers - the Central tier, Points of Presence (PoPs), and Spaces. The Central tier and PoPs are for control, operations, and shared services. Spaces are environments that provide customer identity services as per customers’ needs.

We leverage Kubernetes for lifecycle and runtime management of Auth0’s cloud-native containerized solution. Auth0 is composed of stateless services that are easier to scale. We use MongoDB, PostgreSQL, and Redis as required by the situation. We ensure a robust and performant solution through network isolation and extensive use of edge networks for DDoS protection, rate limiting, and low-latency DNS resolution (including custom domains). The converged architecture's intra-region High Availability (HA) and inter-region geo-failover characteristics help us meet the availability SLAs of Public Cloud deployments.

## Auth0 Services on Multi-Subscriber (Public Cloud) and Single-Subscriber (Private Cloud) Deployments

Auth0 is a Software-as-a-Service (SaaS) solution with two deployment models - Public Cloud and Private Cloud. The Public Cloud is a multi-subscriber environment where resources are shared between customers and is available in the United States, Europe, Australia, Japan, and now in the United Kingdom. Private Cloud deployments, on the other hand, are single-subscriber environments that provide customers with dedicated infrastructure and can be deployed in most regions across Amazon Web Services (AWS) and Microsoft Azure.

The Public Cloud offering is deployed on AWS and addresses the needs of a vast majority of customers. However, customers may choose Private Cloud for a variety of reasons, such as: 

* Geographical requirements that dictate deploying in an area not served by Public Cloud (e.g. for data residency and/or latency reduction)
* Industry-specific needs (e.g., PCI compliance)
* Preference for Microsoft Azure instead of AWS
* Higher transaction volume than allowed on Public Cloud

![Auth0 Services on Multi-Subscriber (Public Cloud)](https://images.ctfassets.net/23aumh6u8s0i/6ex2w8DgyfbKhdJLx1lIPi/60a5ba0c641c9059317da35e9f6aab1c/multi-subscriber-public-cloud-01.png)

## Why Converged Architecture?

The converged architecture allows us to deploy and manage both Public and Private Cloud offerings on the same underpinning. This architecture is built on the following premises:

* Multi-cloud: AWS and Azure cloud support through a common interface
* Container orchestrated: use of container images instead of installing packages
* Stateless: scalable and replaceable by design
* Immutable: run only trusted code and configuration
* Fully automated: provisioning, upgrades, and decommissioning are done by machines
* GitOps: enhanced DevOps, push code and safely reproduce it thousands of times

![Architecture](https://images.ctfassets.net/23aumh6u8s0i/57nIODdJEv5clLYYswHEl5/12fabdd26c7eddf4db40754196ef1659/multi-subscriber-public-cloud-02.png)

The benefits of a single underlying architecture for developing, deploying, and operating services across different environments are manifold. The primary reason is the ability to offer new capabilities to customers faster and at a lower expense. The architecture also allows us to ensure feature parity across different deployment environments seamlessly.

The converged architecture helps in focusing the organization’s energy on a common infrastructure that yields higher developer productivity/velocity. It results in improved platform scalability to address various scaling demands from both multi-subscriber and single-subscriber deployments. It provides a constructive space for assessment and adoption of security practices that might be perceived as unique to one deployment environment type, but have practical implications on the other as well. It also helps with reliability refinements and enhancements across the board. 

Besides optimizing engineering resources, a converged architecture has several other internal benefits through unified automation, toolsets, and processes. It has expedited identification and realization of infrastructure and operational cost optimizations across the board, which helps deliver good value to our customers.

## Deployment Characteristics of Multi-Subscriber Services 

As a reminder, the Public Cloud is designed to host thousands of subscribers over shared resources, whereas a Private Cloud deployment is designed for a single subscriber. 

Ensuring optimal performance and security for the different Public Cloud subscribers is paramount. While the underlying compute, storage, database, networking, domain name, and other resources are shared in a multi-subscriber deployment, this solution ensures each subscriber is isolated within this shared environment.

The database and application workloads are partitioned to ensure an appropriate level of data isolation and security. The Auth0 Public Cloud combines pooled partitioning (i.e., partitioning of data by subscriber identifier) and on-demand subscriber-specific workload instances. The architecture is refined continuously to eliminate “noisy neighbor” problems.

## Public Cloud Platform Infrastructure Architecture

### Tiers - Central, PoPs, and Spaces

Once again, the converged architecture has three tiers - Central, Points of Presence (PoPs), and Spaces. Besides these, the Edge network for DNS and DDoS protection, and Auth0 HQ based systems for analytics and operations complete the picture.

![Tiers - Central, PoPs, and Spaces](https://images.ctfassets.net/23aumh6u8s0i/5wVpjNsZNeyRnxGmRIHLwM/deee78839a615f2ebc1679b65eafc873/multi-subscriber-public-cloud-03.jpg)

It’s important to note that the solution has been designed with isolated fault domains; the control plane and data plane separation allows the central control plane to be offline/under maintenance without impacting customers’ authentication flows.

* **Central**: A globally unique component that contains the platform control plane and other centralized global infrastructure. The control plane manages the creation of Public Cloud environments and keeps them updated with continuous (daily) releases.
* **PoPs**: An intermediate point of infrastructure pinned to a specific cloud region (e.g., AWS us-east-1). The PoP hosts internal visibility tools and securely proxies messages from the central down to the regional Public Cloud environments.
* **Space**: The Public Cloud environment is located ‘beneath’ a PoP in a particular AWS region. These spaces have cross-region geo-failover capabilities to ensure resiliency.

### Aspects - control and runtime, scalability, datastores, networking, and reliability

When Auth0 took on the converged platform project, it started as a small team, initially focused on our single-subscriber (Private Cloud) offerings. This team comprised a cross-section of our platform teams with expertise ranging from Kubernetes to API, tooling, infrastructure, and datastores. They were focused on developing a proof of concept for the converged platform.

As we learned from our experiments — and as the converged platform evolved and matured — we launched single-subscriber environments for general availability. You may read more about this in a series of posts we shared outlining the technical, security, and architectural decisions we made:

* [A Technical Primer of Auth0’s New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/)
* [The Architect’s View of Auth0’s New Private Cloud Platform](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/)
* [Securing Auth0's New Private Cloud Platform](https://auth0.com/blog/securing-auth0s-new-private-cloud-platform/)
* [Data Pipelines on Auth0’s New Private Cloud Platform](https://auth0.com/blog/data-pipelines-on-auth0-s-new-private-cloud-platform/)
* [How We Do Releases in Auth0’s New Private Platform](https://auth0.com/blog/how-we-do-releases-in-auth0-s-new-private-platform/)
* [Optimizing Cost and Performance of Auth0's Private Cloud](https://auth0.com/blog/optimizing-cost-and-performance-of-auth0s-private-cloud/)

We continued the logical progression with the converged platform, and adopted it for Public Cloud. Behind the scenes, the team continued to grow, and eventually, as we began to gain more and more traction from the converged platform, we organized the team into specialties to best support growth.

* **Runtime -** Heavily focused on our Terraform and Kubernetes layers. Ensuring that the core of the platform functions and that automation has the flexibility to meet the needs of product delivery teams.
* **Control -** Owners of our controlling API and platform CLI. The tooling that is used for operating the platform in all cases both normal and incidents.
* **Datastores -** Focused on our data storage technologies and interacting with our product delivery teams and the most efficient way to utilize the available stores.
* **Networking -** Owners of our edge technologies and supporting the myriad of ways in which our customers leverage the edge.
* **Sizing -** Partners with other internal teams to establish the performance characteristics of our offerings and additionally adds improvements to our platform including auto-scaling.
* **Services -** Owners of tooling and services leveraged by product delivery in their development. This includes abstractions that allow for easier access to the underlying platform.
* **Data -** Responsible for ensuring the data flow from the individual environments to the regional Points of Presence (PoPs) and beyond. This includes application logs for support as well as abstracted metrics. 

In order to get the technology behind a solution right, it's critical to fully enable the people behind the technology to co-create innovative solutions. At Okta, we cultivate a BLOC culture, which stands for “Builder, Learner, Owner, and Collaborator.” These values foster a high-functioning, well-oiled machinery that can take on big and small challenges effectively and efficiently.

![BLOC culture](https://images.ctfassets.net/23aumh6u8s0i/1uDGWPkHZzzH5CKHlrvEbJ/114d89fab2474e4cb2aec9272dea795f/multi-subscriber-public-cloud-04.png)

With the different team specializations, collaboration becomes all the more important. At Auth0, we value documentation not only for informing but also for decision-making. Our Engineering teams follow a simple mantra for collaboration: "Write. It. Down." We use Request For Comment (RFC) documents to record architectural designs and Decision Record documents to discuss and align ideas across teams. These documents also provide important context for new team members about what we're building and how we arrived at the decisions we've made and served as an important knowledge base as we began onboarding service owners to the new converged platform. These core tenets have become critical for sustaining the growth of the platform and introducing new capabilities over time.

### Reliability

The converged architecture provides a highly reliable and available solution leveraging not only the High Availability (HA) constructs across three Availability Zones within an AWS region, but also geo-failover capability between Active and Failover regions.

![Reliability](https://images.ctfassets.net/23aumh6u8s0i/2jbDdi3fCuZ1hm6D0qyWCI/ffe5decea1a0c72156636d38073d1975/multi-subscriber-public-cloud-05.png)

The geo-failover regions are always synchronized from the datastores’ perspective, with demanding RPO/RTO and 99.99% availability SLA targets. Once the failover decision is made, a fully automated process is initiated for the failover to take effect.

![Reliability](https://images.ctfassets.net/23aumh6u8s0i/5HQ6xBqVyquDFEK7ewW4kC/299cf5878d8cee63c706c633cc0b1abf/multi-subscriber-public-cloud-06.jpg)

In the event of a multi-region failure (an extremely rare event), we can perform an automated restore from the last backup.

The historical availability metrics are a testament to the robustness of the Auth0 solution. We continue to meet our targets in Private Cloud with the converged architecture and expect to continue meeting or exceeding these targets with Public Cloud deployments on this architecture.

![Private Cloud](https://images.ctfassets.net/23aumh6u8s0i/3xjskcZcaHUYxFuePah6r4/fdd40e7755462d852c29d16293a3bc2e/multi-subscriber-public-cloud-07.png)

## What Next?

Auth0’s Public Cloud offering continues to be boosted across different facets. The availability of Public Cloud across geographies will continue to expand. The launch of the UK Public Cloud region in April 2023 is the latest example, providing yet another regional point of presence for customers with data residency and latency sensitivity needs. Also, support for a Public Performance tier in H2 2023 caters to customers’ higher performance needs on Public Cloud.


We look forward to continuing to deliver new and enhanced customer identity capabilities, ease of use, platform resilience, scalability, and security in our Private Cloud and Public Cloud offerings through the new converged architecture.

Multi-Subscriber (Public Cloud) Deployment on Converged Architecture

Samuel Frank

Sam Frank is Auth0's Sr. Product Manager for new initiatives. He works within the Auth0 Lab to commercialize the team's new ideas so they're available for builders everywhere. As a former platform product manager and startup product lead, he knows the challenges that developers face when creating new apps and he leverages those experiences to focus our teams efforts delivering the next generation of identity tools.

Senior Product Manager

The Customer Identity Cloud platform can now reference NFTs as profile data and as a means to grant access.

The [Auth0 Lab team](http://labs.auth0.com/) has released a pair of [Marketplace integrations](https://auth0.com/marketplace) bringing more [Web3 capabilities](https://marketplace.auth0.com/categories/web3) to the Okta Customer Identity Cloud ecosystem. As the Web3 ecosystem matures, we’re finding that on-chain data, like NFTs (non-fungible tokens), can be used in the identity ecosystem. 

[Our integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) is a simple NFT fetch [Action](https://auth0.com/docs/customize/actions) that retrieves a list of NFTs the user owns. With them, you can make all sorts of IAM-based decisions. If you’re interested in the Auth0 Lab team’s continued Web3 research, come join the conversation on [Twitter](https://twitter.com/Auth0Lab) and [Discord](https://discord.gg/xkbkz9rZcD).

## NFTs in Identity and Access Management (IAM)

By now, you’ve probably heard of NFTs. If not, here [is a helpful explainer](https://www.nytimes.com/interactive/2022/03/18/technology/nft-guide.html). At their core, NFTs are digitally transferable tokens. Tokens have a long history in identity and access management. They are the keystone of authorization in many apps, primarily through the issuance of [JSON web tokens](https://jwt.io/). 

NFTs could be a big extension to token-based IAM. NFTs are flexible, secure, and easily transferable by their nature of using blockchain consensus algorithms to establish ownership and transference. Like with cryptocurrencies, only a specific private key in a wallet can prove ownership. They can help organizations manage capacity problems because you can limit the number of NFTs you mint. This scarcity helps manage supply while still allowing for a robust secondary market. This makes them ideal for ticketed events and venues, like stadiums, trains, and other physically limited spaces.

One of the biggest barriers to mainstream NFT adoption is the usability hurdle of working with blockchains. With our latest integrations, Auth0 Lab seeks to make it easy. Developers can query a user’s NFTs and incorporate them as identity data in their applications, even controlling access based on a user’s ownership of an NFT. We’re excited to see how developers use these new tools when implementing web3 functionality into their applications.

## Token Gating

[Token Gating](https://tokenizedhq.com/token-gating/) is the practice of managing access to resources based on a user’s Web3 NFTs. Notable examples include [‘members only’ communities](https://rarible.com/blog/9-membership-nfts/) of NFT collectors. This exclusivity extends to video games like [Alien Worlds](https://alienworlds.io/), the [largest web3 game](https://www.statista.com/statistics/1266486/blockchain-games-user-number/) at the end of 2022. NFTs are central to the game and unlock certain content, or game locations are only accessible with specific NFTs. [TravelX](https://travelx.io/) is working on another use case around airline tickets.

Token gating is interesting because of the openness of the attestation. Instead of IAM data being stored on a proprietary server, it’s on a public blockchain for anyone to use and see. We’re just witnessing the first experiments in how that data is used. 

## EVM Compatible, Open Source Coming Soon

The current integration works on all [Ethereum virtual machine (EVM) compatible](https://gocrypto.com/en/what-are-evm-compatible-blockchains/) blockchains. This means you’ll have access to NFTs available on some of the largest NFT marketplaces like [OpenSea](https://opensea.io/). You’ll be able to pull from [Ethereum](https://ethereum.org/en/), [Polygon](https://polygon.technology/), [Avalanche](https://www.avax.network/), [Binance Smart Chain](https://www.bnbchain.org/en), and others. EVM blockchains are the oldest programmable blockchains, and the ecosystem is well supported.

The Auth0 Lab team is working on open-source the code so it can be modified and moved to other blockchain platforms. That process takes some time, so keep an eye out by following us on [Twitter](https://twitter.com/Auth0Lab) or heading to our [GitHub organization](https://github.com/auth0-lab) and give it a follow.

## Unlocking NFTs for Your Application

### How it Works

The Auth0 Lab [fetch-nfts integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) works by relying on a few other pieces of infrastructure.

1. It utilizes the [Sign in with Ethereum integration](https://auth0.com/blog/sign-in-with-ethereum-siwe-now-available-on-auth0/) that SpruceID released in the Auth0 Marketplace in 2022. This allows the integration to grab a public blockchain address for the user, which is critical to querying an NFT smart contract to know if they own an NFT. If a user logs in with a method other than Sign in with Ethereum, NFTs won’t be fetched.
2. During [setup and configuration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install), specify a list of NFT contracts that you’d like the [Auth0 Actions](https://auth0.com/actions) code to query. You’ll also need to specify an API key for [The Graph](https://thegraph.com/en/), a service that queries blockchain data.
3. With a public key in hand, and a list of NFT contracts to search, the Actions code calls out to The Graph’s APIs to query the necessary NFT contracts. It returns a list of caip-22 asset references that your Action adds to the [ID token](https://auth0.com/docs/secure/tokens/id-tokens) as claims.
4. From there, you can utilize the data in your application to make any decision, like token gating access, that you feel necessary!

### Installation

Check out our [installation](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install) guide to get started!

## What’s Next?

The Auth0 Lab team is actively exploring the best ways to enable developers to build applications that rely on Web3 identity constructs and help bridge the Web2 and Web3 worlds. You can follow our progress on [Twitter](https://twitter.com/auth0lab). If you’re interested in speaking with the team, join our [Discord](https://discord.gg/xkbkz9rZcD) and start a thread.

The [Auth0 Marketplace](https://marketplace.auth0.com/) is looking for Web3 partners to build new extensions onto Auth0. Visit [https://auth0.com/integrate](https://auth0.com/integrate) to learn more.

Web3 NFTs for Identity and Access Control, Now Available on Marketplace

Cyril David

Cyril is a Platform System Architect at Auth0. He is a seasoned engineer with over a decade of experience in building distributed systems.

Platform System Architect

Designing for quality, reproducibility, and determinism.

**TL;DR**: Releasing individual services today is largely a solved problem. The complexity arises when we need to factor in the combinations of services, the configs and secrets necessary for a given service version, and the underlying infrastructure supporting those services while ensuring quality, reproducibility, and determinism.

## What’s in a Service?

When we talk about services, we largely focus on the code — but other things we might need to account for are:

* Config and Secrets
* Database related migrations
* Related infrastructure dependencies for a particular service version
* Implicit dependencies with other services

## Introducing the Concept of a Release Manifest

Given these problem constraints, we introduced a **release manifest** concept, which we define as a versioned JSON file describing a point-in-time representation of the entire Auth0 product stack, which includes: all service versions and the infrastructure version it was deployed on.

Configs and secrets are also versioned for every release manifest, which are snapshotted in our config/secrets storage.

Just to make it more concrete, here’s a hypothetical snippet:

```json
{
	"version": "v202221.99.0",
	"services": {
		"productpage": {
			"entity": {
				"name": "productpage",
				"default_vcs_branch": "main",
				"stacks": ["STACK_AUTH0"]
			},
			"artifact": {
				"version": "1.464.0",
				"vcs_revision": "dc62808d3a75a814a0748827d74e0936669dfec9",
				"vcs_url": "https://github.com/auth0/productpage",
				"reference": "sample.jfrog.io/docker/productpage:1.464.0",
				"metadata": {
					"build_number": "464",
					"build_started": "2022-05-24T18:52:34.753+0000",
					"build_url": "https://samplebuilds.auth0.net/job/productpage/job/main/464/"
				}
			}
		},
		"reviews": {
			"entity": {
				"name": "reviews",
				"default_vcs_branch": "main",
				"stacks": ["STACK_AUTH0"]
			},
			"artifact": {
				"version": "1.31.0",
				"vcs_revision": "dc62808d3a75a814a0748827d74e0936669dfec9",
				"vcs_url": "https://github.com/auth0/reviews",
				"reference": "sample.jfrog.io/docker/reviews:1.31.0",
				"metadata": {
					"build_number": "31",
					"build_started": "2022-05-24T18:52:34.753+0000",
					"build_url": "https://samplebuilds.auth0.net/job/reviews/job/main/31/"
				}
			}
		}
	}
}
```

A couple of notes:

* The version `v202221.99.0` is based on a year/week scheme (e.g., year`2022`, week `21`) and just a monotonic minor version which represents an atomic change.
* In this example, we only have two services called `productpage` (versioned `1.464.0`) and `reviews` (versioned `1.31.0`).
* This file is committed within our central git ops repository, with a matching tag `v202221.99.0` where the underlying infrastructure as code is also versioned for that specific point in time.
* Config/secrets aren’t versioned in git — but instead are stored separately in our config/secrets storage where we have the ability to snapshot them based on a specific version (in this case, all secrets/config have the same version `v202221.99.0`attached as metadata).

With this construct defined, we now have a baseline primitive for ensuring the properties we set out to solve initially:

* **Quality** — we can easily run our suites of system tests against a given version to ensure that our features work as expected.
* **Reproducibility** — we can create as many different spaces for testing or for onboarding new customers.
* **Determinism** — we’re guaranteed we have the same combination of service versions, config/secrets, database migrations, and infrastructure.

## A Note about Database Migrations

Database migrations themselves are a vast topic that is beyond the scope of this blog post, but the core properties we need to ensure are:

* **Forwards and backwards compatibility** – that a new version can be read by old code, and new code can work with the old schema.
* **Idempotency** – that any transient failures are wrapped in a transaction so we can retry the entire job if it fails. In addition, being able to run the same job once completed should be a no-op.

We utilize kubernetes jobs as the underlying primitive to run these database migrations and write them in such a way that retries during transient failures are ok — and that if we have to roll back, the previous service version will work with the new database migration.

Rollback is only within a reasonable constraint – in our case, the constraint is one major version away, which means a weekly version. So we only need to ensure backward/forward compatibility one major version away.

## Deploying a Release Manifest-Version

Given that we have all the necessary information codified in a release manifest version, the next step is to deploy older versions to a new version. Taking our hypothetical example:

* We have the current version `v202221.99.0`
* We need to deploy to a new version `v202222.105.0`

### Maintenance windows

Our private cloud customers can define a maintenance window where their space gets deployed every week. This means that these versions can only go out during that maintenance window — and that if anything potentially goes wrong, we have the ability to stop the release and Rollback to the prior version.

### Promotion pipeline

Like any release pipeline, we define a hierarchical set of channels; let’s imagine the following hypothetical example:

```
stage
+- internal
   +- free
      +- enterprise
         +- private cloud dev
            +- private cloud prod
```

So, in this case, if the stage had the version `v202221.99.0`, it means we need to deploy it _first_ to `v202222.105.0` before we can deploy `internal` to `v202222.105.0` and so forth.

### Rolling back

If, for any reason, a deployment encounters an error, we can roll back by shifting traffic back to the previous stable cluster.

## What’s Next?

The new release pipeline we’ve developed is only the beginning – and we’re planning to build more innovative tools for our platform in order to consistently deliver excellent service and reliability to our customers.

We are publishing a series of technical posts on how and why we replatformed. They’ll be linked at the bottom of this post as they publish and are also findable on our blog. If you have technical questions or ideas for future posts, please reach out to us via the [Auth0 Community](https://community.auth0.com/). (Our marketing team also tells us we would be remiss if we didn’t include a link to talk to Sales, so that is [here](https://auth0.com/contact-us), too.)

How We Do Releases in Auth0’s New Private Platform

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

New partnerships aim to bring secure customer identity to the platforms developers use every day in one click, or less

Almost a decade ago, _The New Kingmakers_ made reference to the rise of a developer class that would fundamentally reshape technology decision-making. Today, two-thirds of professional developers have a voice when their organizations are purchasing new technologies, according to [Stack Overflow](https://survey.stackoverflow.co/2022/#technology-most-loved-dreaded-and-wanted). Product-led growth is official “a thing,” and companies that make life easier for developers have been crowned with success again and again.

The acquisition of Auth0 accelerated Okta’s own journey with developers. Over 2.8 million unique developers look to [Auth0, now the Okta Customer Identity Cloud](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/) each month for expertise on how to implement customer identity, across in-person events, the Auth0 Ambassador program, and digital channels like docs, technical blogs, and JWT.io.

Today, at [Oktane22](https://www.okta.com/oktane22/), we announced the next giant leap in our journey toward making identity easier for developers: New partnerships with three of the leading developer platforms: DigitalOcean, Netlify, and Vercel. These are like-minded platforms that put developers at the heart of their missions. Together, we intend to bring expert advice and easy integrations to where developers already spend their time–with the ultimate vision of providing secure customer identity in one click or less within each platform environment.

“Creating compelling experiences is hard enough without having to be an identity expert, too. And the stakes are too high to get it wrong,” said Shiven Ramji, Chief Product Officer, Customer Identity at Okta. “Okta Customer Identity Cloud powered by Auth0 can be called by your app and hosted in your cloud of choice, but we don’t want to stop there. This is the first step in a multi-year journey to fully integrate secure identity capabilities where developers are building the future. We are honored to have DigitalOcean, Netlify, and Vercel join us on this quest.”

## Abstracting Away Complexity

Developers are facing all kinds of application complexity and maintenance work that takes them away from innovation. The Covid-19 pandemic only amplified the need to be hyper-focused on shipping differentiated, user-centric products. Security has become a cat-and-mouse game as attackers shift their tactics and new privacy laws are established. Developers need to balance all of these priorities while dealing with resourcing and talent pressures.

Customer identity stands at the intersection of these forces: security, privacy, and user experience. Getting it right enables everyone to safely access any technology and developers to integrate customer identities across the stack. But according to a [Gartner](https://www.gartner.com/en/documents/4009255)® report, “The cost of maintaining a homegrown CIAM toolset has grown, compared with commercial offerings. There is a growing preference for buying versus building, which is enabling the business to refocus development resources.”

## Empowering Developers for a Safer Internet

Together, we believe Okta, DigitalOcean, Netlify, and Vercel can streamline the education, implementation, and activation of customer identity for developers across the globe. Today, we’re starting with improving education and awareness around the complexity of identity, followed by improving discoverability for our integrations along the developer journey, with the ultimate vision of one-click integrations.

Democratizing access to enterprise-grade customer identity for developers will have a massive impact on the security of end-consumers and empower developers to focus on innovation. As part of Okta Customer Identity Cloud, we can put adaptive multi-factor authentication (MFA), bot detection, passkeys, and more in the hands of developers with the literal flip of a switch. Meeting developers where they are is a key part of our strategy, and we couldn’t be more excited to welcome DigitalOcean, Netlify, and Vercel to our network.

“We’re very excited to be working with Okta to better equip developers and small businesses to add customer identity into their Apps built on DigitalOcean,” said Tyler Healy, Vice President of Security at [DigitalOcean](https://www.digitalocean.com/). “When it comes to developers and digital entrepreneurs, simplicity is vital. This partnership will only further DigitalOcean’s ability to simplify innovation on our platform and enable builders to spend more time creating software that changes the world.”

“Developers are moving to a decoupled, composable web architecture because they want more flexibility to use any tool or framework to build faster, better-performing web experiences. At the same time, they need a great developer experience in a simple workflow. That’s where Netlify plays a key role as the platform connecting all developer’s tools, including Auth0 by Okta, and APIs in one place to build and run web apps. Working with Okta, we look forward to making identity and authentication as easy and simple as possible for millions of developers,” said Matt Biilmann, CEO and co-founder [Netlify](https://www.netlify.com/)

“As a leading cloud platform for frontend developers, Vercel provides innovators with the speed and reliability they need to create at the moment of inspiration. Security and identity are at the core of building delightful digital experiences,” said Malte Ubl, CTO at [Vercel](https://vercel.com/). “By joining forces with Okta, we’re not only simplifying the role that identity plays on the web but also making a commitment to enhancing the speed and breadth of developer-friendly cybersecurity in an increasingly digital world.” 

## Neutrality to Build Your App, Your Way

Developers want the freedom and power to choose the best solutions for their digital ecosystem. Okta’s commitment to neutrality means not being restricted to a specific technology stack and having the ability to control and customize identity now and in the future. We are designing easy-to-integrate solutions that free developers to use any technology, regardless of platform, device, or infrastructure. We are 100% focused on identity, so developers can focus on innovation.

## Availability and Signup

Developers can learn more about Okta’s new developer platform partnerships and get started with Okta Customer Identity Cloud [on our Developer Center](https://developer.auth0.com/resources/get-started/cloud?utm_source=blog&utm_medium=website&utm_campaign=partnerships). We will release more information about the DigitalOcean, Netlify, and Vercel integrations as they become available.

If you’re a developer platform interested in joining our quest to make identity easier for developers, [please reach out to our tech partnerships team](https://docs.google.com/forms/d/e/1FAIpQLSfGzaE5a6-OSy1D1N8PMeSE8pXCfsr4UkzDqUpW-vUGq2rYHg/viewform).

## About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](http://okta.com/).

Okta Partners with DigitalOcean, Netlify, and Vercel to Simplify Identity for Developer

Dan McCorriston

Senior Product Marketing Manager

Now, all Auth0 customers - including those on our private cloud platform - have access to all the offerings on the Auth0 Marketplace.

Auth0 is excited to announce a newly expanded offering for [our new private cloud platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) customers - Actions Integrations are now available from the Auth0 Marketplace. What that means is all Auth0 customers that utilize our new private cloud platform have access to all the offerings on the Auth0 Marketplace - SSO, Social Connections, Log Streaming Integrations, and now, Actions Integrations.

Actions Integrations will start to appear in the Development/Staging space now and will be ready in the Production environment in the coming weeks dependent on various release cadences.

### What are Actions Integrations and the Auth0 Marketplace, and why should I care?

At Auth0, we realize that many customers have unique needs, and as a result, they want the ability to customize their identity product. In order to serve these additional customer needs, Auth0 built a variety of tools to extend the functionality of identity. This concept is called **extensibility.**

Auth0 Actions and Actions Integrations is the next generation of **extensibility**. Actions is the low-code offering, and Actions Integrations allows customers to use pre-written no-code, drag and drop options to add other functionality such as ID proofing and consent management. Auth0 provides this additional functionality through integrations with **our Ecosystem partners** offered in the Marketplace.

The Auth0 Marketplace and Auth0 Actions are the two complementary ways we extend Auth0. Customers and their end users need the ability to resolve their unique identity requirements — which may include payments, subscription management, signing terms of services, etc. — to complete a successful user access journey into their application or service.

### What is Private Cloud?

Auth0’s [Private Cloud offering](https://auth0.com/cloud) provides the flexibility and agility offered by cloud deployments but also allows a customer to maintain the control and security they need to protect their customers and their businesses. Many customers that have high security and regulatory concerns - those in the financial services industry, for example - may require certain standards of uptimes, updates, failovers, and support for their deployments. The Auth0 Private Cloud deployment models come in both Standard and Managed levels, depending on the customer’s requirements.

Auth0 [recently invested in retooling the Private Cloud platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) to support more automation, adopt current technologies and help scale the Private Cloud to thousands of environments.

### Benefit of Private Cloud and Actions Integrations

Private Cloud has a strong appeal for customers who have high volume or who are from certain verticals. For example, verticals like banking, where shared databases are a concern. Or customers who have data residency requirements or even those who prefer to deploy in a specific region close to their customers. Private Cloud customers do not have to be concerned with sharing space, public cloud request limits, and multiple customer’s data being present in the same deployment. 

Many of the same customers that have a need for Private Cloud also have extensive use cases for extensibility and the no-code integrations available in the Auth0 Marketplace. Easy-to-use integrations such as Identity Proofing and Customer Data Management. With Actions Integrations, developers no longer need to build or maintain custom code or make changes when we alter programming models or release new versions of Node. These Actions Integrations are built and maintained by our Ecosystem partners and are available right in the Auth0 Marketplace. 

A couple of examples of Actions Integrations available in the Auth0 Marketplace:

* [**Deduce Intelligent MFA**](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa): Deduce prevents consumer-facing Account Takeover (ATO) and registration fraud via the constantly growing Deduce Identity Network, with over 400M profiles and in excess of 1.2B daily activities. Deduce risk signals significantly reduces false positive MFA challenges.
* [**Tealium User Login**](https://marketplace.auth0.com/integrations/tealium): Tealium connects customer data - web, mobile, offline, Internet of Things (IoT) - so brands can connect with their customers. Tealium empowers companies to create a unified, real-time customer data infrastructure and makes customer data more valuable, actionable, and secure.

### Is this an increased opportunity for Ecosystem Partners?

Now that Private Cloud customers have access to Actions Integrations in the Auth0 Marketplace, our Ecosystem Partners have a new and expanded pool of potential customers to reach through building and publishing Actions Integrations into the Marketplace. There’s never been a better time to become an Ecosystem Partner and market your Actions Integrations through the Auth0 Marketplace.

Make sure to visit the [Auth0 Marketplace](https://marketplace.auth0.com/) to see if there is an integration that optimizes your customer’s identity experience. To find out more about becoming a [Private Cloud](https://auth0.com/docs/deploy-monitor/deploy-private-cloud) customer, please [send an inquiry](https://auth0.com/get-started?place=documentation%20post&type=link&text=contact%20auth0%20sales) and someone from Auth0 will contact you about whether it’s a good fit for your business.

Actions Integrations Now Available in Private Cloud

liz-rivera

At Auth0 I'm responsible for clearly and concisely communicating the value of our CIAM platform. What a great role to be in as digital technologies and applications increasingly become ingrained in our everyday lives. I also oversee the Healthcare vertical, which I'm super passionate about, as digital advances are already recreating the way we receive care.

Senior Product Marketing Manager, CIAM

Liz Rivera

Auth0 has a new CDP partner in our Marketplace

Digital interactions are increasingly dynamic as brands accelerate digitization - adding more digital channels and services to cater to consumer demands for convenient and seamless access to services from anywhere. This reality has fueled an explosion of data being collected across a wide array of channels and customer data repositories, which not only makes it difficult for marketing teams to get a single view of customers but also makes it challenging to trust the accuracy of the data.  

When customers cannot be accurately identified, this skews analytics and impedes true understanding of customers, their preferences, and behaviors across all digital properties, which is critical to driving adoption and customer lifetime value. This has sparked a growing need to bridge the gap between marketing and Customer Identity & Access Management (CIAM), combining identity and marketing to create a holistic picture of user behaviors. 

### Breaking down silos with customer data platforms (CDPs)

Brands collect customer data across various channels (web, mobile) and systems (martech, eCommerce, customer care) with the goal of extracting insights to enrich the experience. Unfortunately, these customer data sources act as islands creating siloed views of customers, impacting the ability to effectively analyze and personalize the experience.  

Centralizing customer data is the first step toward fueling the understanding of customers. Today, organizations are turning to customer data platforms (CDPs), which serve as master customer data stores. CDPs aggregate customer data across multiple channels and repositories, unifying previously disparate data silos to create unified customer profiles — the customer 360. 

CDPs enable marketing teams to optimize the timing and targeting of offers, communication, and engagement activities by allowing the analysis of behavior across the customer journey. However, without a proper identity verification source, the legitimacy of the data comes into question.  

Because CDPs aggregate previously collected data, it is difficult to know how valid the data is. The data may have been collected in a channel without gaining proper consent, the customer's identity may still be unknown (e.g., anonymous profiles), and/or the contact details have become outdated or were never validated.

### Source of truth: Customer Identity and Access Management

Traditionally, CIAM has been a form of front-line security. However, it has reciprocal value across an organization as it is the front door to your digital services and products. CIAM is how customers adopt and engage with your digital products and services and gives you the means to accurately identify, collect, analyze and secure their data. 

CIAM provides a unified interface for customers to sign up and sign in to your products and services - it is often the first touchpoint at which customers become identifiable. The data that is collected during these events is not only verified through authentication events but can span deterministic data, customer data brought in from other identity providers (e.g., social or enterprise repositories), the devices being used to access services, and the location services are being consumed from.   

This valuable source of truth can be used to connect customer identity across all digital services, including their preferences, usage patterns, and consent. 

### CIAM and CDPs: Powering the marketing funnel

Investment in a CDP is made to better understand customers in order to drive conversions, ROI, customer retention, engagement, loyalty, funnel optimization, and customer experience. Enriching the customer profile with essential identity data across all applications can further accelerate the value of a CDP investment.

Through bi-directional synchronization with CDPs and other martech systems, CIAM data can be used to:

* **Connect anonymous profiles to known customers **by providing verified identity data at signups, such as IP address and device identifiers. The CDP can ingest this data and correlate it to a previously unknown profile. With third-party cookies going away and mobile devices limiting app tracking, this capability is essential for marketers looking to understand their customers’ behaviors across their pre and post-account creation activity and engagement regardless of application or channel. 
* **Enrich user profiles with accurate, customer-provided data.** CIAM verifies users’ identities during registration and login, using identifiers such as email or mobile number. If the CDP detects a change/update, it will update the user profile with the new data.   
* **Power analytics with actionable identity data spanning how, where, and when users are signing up and signing into applications**. CIAM plays a central role in the conversion funnel. The acquisition is tied to signup, and retention is tied to the login experience associated with your digital services. Not having a unified view of these processes and a way to analyze and take action on this data can lead to friction, which creates frustration and leads to lost conversions. By providing a CDP with this data, which in turn is shared with martech and analytics systems, markets can develop a deeper understanding of customers’ behaviors and transaction patterns to identify threats, points of friction, and opportunities for segmentation. 

### Auth0: Unifying and powering existing tech stacks with identity data

At Auth0, we position ourselves as an essential component in the end-to-end digital relationship. Auth0 serves as a foundation to unify an organization's existing tech stack as it integrates and enables a broad ecosystem of technologies and applications spanning applications, APIs, martech, content management, fraud, privacy, sales, and customer care systems.  

Essentially Auth0 acts as a single source of truth for identity data spanning: 

1. Identifiers a user is providing when creating an account
2. Locales, devices, and IPs that the user is logging in from
3. Number of times a user is logging in
4. Applications the user is logging in to
5. Risk profile of the login that the user completed
6. Verified email or the phone number used during the authentication challenge

By sharing this data with downstream systems, Auth0 can boost business outcomes across an entire organization, for instance: 

* Marketing teams to power analytics to better gauge conversion and derive benefits from clean, trusted data.
* Customer support agents to leverage login activity to better service customers.
* Security teams to utilize transactional data to diagnose a potential account breach.  

We are constantly adding partner integrations to our Marketplace to allow our customers to power their tech stack easily and quickly with identity data. [Tealium](https://tealium.com/) recently launched a new CDP integration on the Auth0 Marketplace - [Tealium User Login](https://marketplace.auth0.com/integrations/tealium).  This integration enables marketing and digital teams to leverage Auth0 identity data to connect anonymous profiles to known users and enrich user profiles with accurate and up-to-date data.  

As we continue to grow our CDP footprint, our partner integrations will have an emphasis on helping consumer businesses better understand customers and drive conversion. These pre-built integrations, like Tealium, allow customers to configure and deploy a CDP without employing developers to build a custom solution. 

Be on the lookout as our partners continue to build out new CDP integrations in the [Auth0 Marketplace](http://marketplace.auth0.com/).

Why You Should Integrate Customer Identity and Your Customer Data Platform (CDP)

Uploaded from Data Pipelines on Auth0’s New Private Cloud Platform

Andrew is a Staff Engineer at Auth0 focusing on bytes that move for the new Auth0 platform. He is a startup co-founder with over a decade of experience delivering developer focused products at scale. When not at the computer, you can find him hiking up mountains, watching improv comedy, or spending quality time with his wife and son.

Staff Engineer

Andrew Hawker

“Data goes in; data goes out. You can’t explain that.”

**TL;DR:** Auth0 has replatformed our private cloud offering onto Kubernetes. As part of this new architecture, we’ve had the opportunity to apply modern practices to the data infrastructure that powers near real-time features and provides the necessary knobs for data governance.

_Hello friends! Before we get started, I recommend that you check out “[A Technical Primer of Auth0’s New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/)”, “[Architecture of the New Platform](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/)”, and “[Security of the New Platform](https://auth0.com/blog/securing-auth0s-new-private-cloud-platform/)”. These wonderful posts cover foundational aspects of the platform that I will build upon here._

## Introduction

“Data is the new oil,” quipped Clive Humby in 2006, and the industry has been chanting “Drill, baby, drill” ever since. Just like oil, data needs to be refined/processed/transformed to unlock its full value. As the saying goes, “Necessity is the mother of invention,” so the industry has birthed an entire specialization around Data (Science, Engineering, Platform, Warehouse) to extract that value. The analogy remains apt because, just like oil, data is now being respected as a potentially hazardous material. With GDPR, CCPA, and their future brethren, we’ve come to understand the importance of proper packaging and safe keeping of our data assets. No more ziplock bags of data goop in the trunk of my Dodge Neon. Neatly stacked steel crates with big padlocks under 24/7 surveillance that can be crypto shredded at a moment's notice is the future of data management. With this New Platform initiative at Auth0, we’ve had the opportunity to apply some modern practices to our data infrastructure and take another step towards that dystopian data future.

![Introduction](https://images.ctfassets.net/23aumh6u8s0i/5GGILFTY6KNSabp6Ixn2dA/1b6a7923fa10b614f320c94cf436c2b9/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

Taking a page from Leo’s 10k foot view in “[Architecture of the New Platform](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/)”, we’ll be touching on the highlighted sections of the platform in this post. We’ll start with some introductory context, discuss our guiding principles, dive into the tools we chose, and then exercise them with a few sample scenarios commonly seen at Auth0.

Put down that bag of data goop, and let’s get started!

## What is a Data Pipeline?

_“In a world where SaaS and microservices have taken over...”_ — Movie Voiceover Guy

*Looks around*

“Hey, he’s talking about us!”

Software is on a hockey stick growth curve of complexity. We’ve got an ever-increasing number of disparate systems hoarding data and even higher demand on us to unlock value from it.

1. “Show me the region where credential stuffing attacks are originating from” — A customer dashboard
2. “Let me run custom code in an Auth0 Action immediately after a user is deleted” — A feature request
3. “Show me failed login counts from the past 60 days for all tenants on the Performance tier that have been a paying customer for more than one year” — An upsell opportunity

Before we can begin to actually answer any of those questions, we need the connective tissue to ship data from Point A to Point B enriched with E and transformed by T. That’s the role of the Data Pipeline.

That’s not to say that Data Pipelines just carry simple domain/product events. Application logs, exception stack traces, Stripe purchase orders, Salesforce billing updates, etc., are all events that can be emitted and flow through a pipeline.

_“The Data Pipeline is a series of tubes.”_ — Michael Scott

Eh, close enough.

## Our Guiding Principles

Before jumping into implementation, it’s important to understand that _our_ requirements are not necessarily _your_ requirements. The decisions we’ve made might not be the correct decisions for you! When evaluating solutions and discussing tradeoffs, these are some of the key points that helped guide us.

### Event Durability

Event durability is a supremely important requirement for us; missing and out-of-order events are a non-starter.

If we imagine emitting a simple event, e.g., “UserCreated,” there are a few approaches:

1. Integration/domain event from application code
2. [Outbox Pattern](https://microservices.io/patterns/data/transactional-outbox.html)
3. [Change Data Capture (CDC)](https://en.wikipedia.org/wiki/Change_data_capture)

Discussing tradeoffs between these is a blog post in itself, so I’ll just simply say that they’re complementary and fit different needs, with the main tradeoff being durability vs. coupling.

Events emitted by application code can get lost with failures during dual writes. Outbox Pattern struggles if you don’t have strong transactional guarantees with your database of choice and doubles your write load. Change Data Capture (CDC) is the most durable of the three but “ships” the database table schema in each event, promoting unnecessarily tight coupling and having limited access to only the modified row.

### Data Governance (O Data, Where art thou?)

Data Pipelines come in different shapes and sizes.

* Are messages serialized as Avro, JSON, or Protobuf? XML? _Crickets._
* Are they encrypted or plain text?
* What is the expected throughput? Sustained or burst?
* Streaming or batch processing?
* Do producers retry or drop events during downtime?
* What enrichments/transforms do we need to apply?

Before discussing these technical details of a pipeline, we must first consider what is **_in_** the pipeline.

1. Do messages within the pipeline contain Customer Data?
2. Do messages within the pipeline need to leave the region where they originated?

If you answered “Yes” to one or more of the previous questions, calmly go outside and light your computer on fire. Joking aside, by asking and answering those questions, you can begin to understand the security/compliance posture you must take. This is likely to lead you down the road of even more questions.

* What region is data being shipped to relative to where it’s generated?
* Are we sending aggregated data or individual records?
* How is this data encrypted in transit and at rest?
* What Customer Data (down to each individual field) are we processing?
* Are there treatments that are sufficient for each field to be compliant while still fulfilling the business need? Masking, partial redaction, hashing, encryption, etc.

Remember that data is a valuable resource but can also be a hazardous material and must be handled properly. If you discover cases of processing Customer Data and shipping it across geographic boundaries, find yourself a buddy in the compliance department to help sort it out.

### Inertia

Event streaming technology is an active area of development, with many new companies and products entering the space. This is great because we can stand on the shoulders of giants, but if you’re not careful, it can leave you prone to painful churn, deprecation, incompatibility, or entire products going bust.

While we don’t want to fully jump into the [Boring Technology Club](https://boringtechnology.club/) pool, we _do_ want to build on robust tools that will survive a hype cycle. If a project doesn’t have enough inertia and community buy-in to survive the departure of the original stewards, it might be best to consider an alternative.

### Composition

The only constant in life is changing, especially technological and business requirements. We need to consider how our technology choices can be composed, merged, bent, broken, and smeared together to get the job done. If we choose a solution too rigid, it’ll be re-written often. A solution too flexible is unlikely to be fully understood. We should try and use tools that provide a healthy balance.

## It's Dangerous to Go Alone! Take This

We’re not the only company building on data pipeline technologies, thankfully. We can stand on the shoulders of those before us. Using our guiding principles outlined above, here’s the alphabet soup of open source technologies we chose to plug together to make our data go.

#### Kafka

The original Auth0 platform was built to run only on AWS and heavily leveraged Kinesis, SQS, and RabbitMQ. When evaluating cloud-agnostic solutions for the new platform, it was difficult to say no to [Kafka](https://kafka.apache.org/). With most cloud providers offering a hosted solution (or API-compatible layer), it’s becoming the lingua franca for durable event backends. With relatively sane approaches to implementing encryption at rest or in-flight, it meets most of our needs right out of the gate.

#### Kafka Connect

[Kafka Connect](https://docs.confluent.io/platform/current/connect/index.html) has a solid ecosystem of integrations that is relatively plug-and-play (although schema vs. schema-less can be a pain). The [AWS S3](https://docs.confluent.io/kafka-connect-s3-sink/current/overview.html) sink connector was available to us immediately, and an open-source [Opensearch](https://github.com/aiven/opensearch-connector-for-apache-kafka) connector popped up quickly after the Elasticsearch license fork snafu.

[Single Message Transforms (SMT)](https://docs.confluent.io/platform/current/connect/transforms/overview.html) within a connector are simple mechanisms for stateless transformation/enrichment of all messages. This works well for us to inject static metadata from the new platform like Space, POP, Cloud, current deployment version, etc.

#### Schema Registry

Kafka Connect heavily utilizes the[ Confluent Schema Registry](https://docs.confluent.io/platform/current/schema-registry/index.html) for message serialization and validation. While some connectors support “schemaless” messages, you’ll find yourself, as we have, swimming upstream if you don’t leverage the registry with these tools. We haven’t fully realized our vision here and plan further investment over the next few quarters.

#### Debezium

As I mentioned before, event durability was an extremely important requirement for us, so we started with Change Data Capture (CDC) powered by [Debezium](https://debezium.io/). With their [MongoDB](https://debezium.io/documentation/reference/stable/connectors/mongodb.html) and [Postgres](https://debezium.io/documentation/reference/stable/connectors/postgresql.html) source connectors, we’re immediately plugged into the Kafka Connect ecosystem.

#### Data Shield

When it comes to data policy enforcement for streaming messages, there didn’t seem to be many free/open-source solutions we could take off the shelf. For this, we wrote our own in-house solution in [golang](https://go.dev/).

Data Shield handles data policy enforcement with schemas, data mutation, and topic muxing. With it, we can define events flowing through a topic using an IDL like [protobuf](https://developers.google.com/protocol-buffers). The IDL is not tied to the serialization format in the topic, e.g., we can use a protobuf IDL for JSON events.

Let’s walk through a quick example. Let’s say we emit events of Company records that have a field for their EIN.

```
message Company {
  string name = 1;
  string address = 2;
  string ein = 3;
  string url = 4;
}
```

Field enforcement is zero-trust by default, so any fields not defined in the IDL are automatically excluded. This is a critical capability for us since we receive many JSON/BSON-based events with loose schemas where fields can easily be added/removed by the upstream producer. This minimizes the blast radius of an upstream service accidentally or intentionally producing new fields with Customer Data on streams that leave the region.

Using the IDL, we annotate fields with policy details like classification and treatment rules. From our Company example, let's assume the **_ein_** field is classified as Personally Identifiable Information (PII). We could model this as:

```
  string ein = 3 [
    json_name = "ein",
    (auth0.proto.options.fields.v1.classification) = {
      classification: PII,
    },
    (auth0.proto.options.fields.v1.transform) = {
      processor: {
        name: OPENSEARCH,
        transforms: [
          { mask: { length: 4, character: "*", reverse: true } }
        ]
      },
      processor: {
        name: FRAUD_DETECTION,
        transforms: []
      },
      processor: {
        name: EU_DATA_LAKE,
        transforms: [
          { drop: { } }
        ]
      },
      }
    }
  ];
```

Each separate data processor of the stream can apply their own independent rules based on their business function. In this case, our Observability stack in Opensearch has the last four characters masked, our Fraud Detection feature receives the value in plain text, and the Data Lake processor in the EU doesn’t receive it at all.

With this IDL definition and some minor service configuration, we can tell Data Shield to enforce the policy on one or more topics. In the simple case, it will take the incoming “dirty” topics and output “clean” topics, one for each data processor with their specific rules applied.

![IDL](https://images.ctfassets.net/23aumh6u8s0i/3ka0jensdx70UoBfYmdnrd/c85e55476cde1771e397710a63058d61/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

This multiplexing increases our storage costs but allows us to leverage different retention policies and Kafka ACLs so consumers can only access data from their assigned topics. While this is a cost we are (currently) willing to pay for strict data isolation, it is an area for future investment with a potential “decryption and schema enforcement on reading” strategy.

As we’ve iterated on the Data Shield concept, we’ve added a few more features to make our lives easier.

* One-to-many topic to IDL schema mapping for topics with heterogeneous message types. This is very helpful for topics that contain app/service logs.
* Schema format conversions, e.g., read JSON, write Avro
* Extend IDL to support field enrichment with generated runtime values
* Golang API for pluggable actions to modify processing pipeline as events flow through
* Rate-based sampling for sinks that can be overwhelmed

## Scenarios

With our guiding principles leading us to those tools, let’s diagram out a few simplified versions of scenarios we run on the new Auth0 platform.

### Application logs for incident response

In this scenario, we’re using [Fluent Bit](https://fluentbit.io/) to consume service logs from all pods within the Space Kubernetes cluster. They’re shipped to Kafka, where Data Shield consumes the raw log messages, applies its enforcement rules, and produces them back to Kafka. They’re consumed by Opensearch connectors, who ship them across the private link to the POP, where they’re accessible to Operations teams for incident response.

![Application logs for incident response](https://images.ctfassets.net/23aumh6u8s0i/5LkE9v6OyZJpJA85G1lJM7/1e3a523222efba8065f4359b47e456c4/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

### Events for autocomplete search

In this scenario, we’re using Debezium to consume MongoDB change streams to emit events for Auth0 Users into Kafka. Data Shield consumes them, applies its enforcement rules, transforms the structure, and produces them back to Kafka. They’re consumed by another service that processes them and writes them into Postgres running in the same region.

![Events for autocomplete search](https://images.ctfassets.net/23aumh6u8s0i/6WCxg7eRdAuOdGm0MslthE/2886847192f02ae1b1c1cdef18514760/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

### Event counts to a data lake

In this scenario, we’re using Debezium to consume the Postgres logical replication protocol to emit events for Auth0 Connections into Kafka. Data Shield consumes them, applies its enforcement rules, and ships them back to Kafka. They’re consumed by S3 connectors that ship them to an S3 bucket running in a different region.

![Event counts to a data lake](https://images.ctfassets.net/23aumh6u8s0i/4BlUDX70CAZfZ0wl1JOU39/5ce6cf28061d37de489e51bede949ea6/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

### User requested backups 

In this scenario, we're emitting product events for Auth0 Tenants into Kafka. Prior to processing by Data Shield, they’re backed up in-region to object storage. The backups are then periodically rolled up and offered as a data download upon user request in a dashboard.

![User requested backups ](https://images.ctfassets.net/23aumh6u8s0i/6PzHrtwKWMgRzKsp7Hun2V/ee40263dbe880df9975304e07d517945/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

## We’re Just Getting Started

Although these sample scenarios aren’t terribly complex, they really show the power of composability. We can mix and match a few Kafka connectors with Data Shield to meet the needs of our customers while providing the data controls we require. With more data-intensive use cases on the horizon needing stream processing and OLAP databases, this composability means our pipelines can easily evolve to support them. More importantly, even with a team experienced in stream processing and OLAP databases, we’ll still plan an R&D phase to make sure our choices once again align with our guiding principles.

Interested in hearing more about streaming joins, windowing, and OLAP databases? Well, you’ll have to wait for my next blog post then! Muahaha.

I would be remiss if I did not tell you that Auth0 (and specifically my team) are [hiring](https://auth0.com/careers)! Join me in building the next Auth0 data platform solving real problems for real people. Interested in solving problems for fake people instead? Visit the social network nearest you.

Data Pipelines on Auth0’s New Private Cloud Platform

Jon May

Jon May is a Principal Security Engineer at Auth0 where he is responsible for securing the platform and infrastructure of the Auth0 Identity Platform. He has over 10 years experience in cybersecurity and technology and holds a bachelor’s degree in economics from Brown University. Prior to joining Auth0, Jon was a Security Architect at Bridgewater Associates where he was responsible for designing and implementing cloud and enterprise security controls.

Principal Security Engineer, Platform Security

Architecting and building a new platform that is secure by design.

**TL;DR:** Auth0 replatformed our private cloud offering into a multi-cloud Kubernetes architecture. This large architectural change brings with it new threats and new security challenges. We took the opportunity to design and integrate security into the platform from the start, as opposed to "bolting it on" at the end.

In this post, we'll discuss how we approached securely replatforming the Auth0 Identity Platform into a large, multi-cloud architecture. We'll walk through the risks that most concern Auth0's Security team and the threats that could result in those risks becoming real, tangible, negative outcomes. After that, we'll discuss the challenges our team encountered while addressing those threats in a multi-cloud environment alongside the principles we applied to address them. Finally, we'll review the controls Auth0 put in place to mitigate the identified threats.

If you haven't read the previous posts yet, [A Technical Primer of Auth0's New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) and [The Architect's View of Auth0's New Private Cloud Platform](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/), I encourage you to check them out first. They provide foundational knowledge and context which will help you better understand this post. 

## Understanding What Risks Affect Us

At the highest level, Auth0's Security team is responsible for identifying, assessing, and mitigating risks to our business and, in effect, our customers. It's our job to reduce the impact and/or likelihood of undesirable business outcomes caused by security events. Specifically, we're interested in mitigating security and privacy risks, such as those involving:

1. **Product/platform compromises**: bad actors gaining control of a product or platform component
2. **Customer or Auth0 data loss**: unintended deletion or unauthorized access to customer or Auth0 data
3. **Service disruptions and outages**: disrupting the Auth0 service and causing an outage for our customers

There are more risks than the three listed above and more nuance as well, but we'll use them for brevity. These high-level risks help us enumerate our list of threats.

## Identifying How the Platform Will be Attacked

This new Kubernetes-native, multi-cloud architecture is large and complex, which makes it challenging to secure. Our approach is to start by enumerating the areas of the architecture most likely to be targeted and how they can be attacked. This process, called threat modeling, helps us determine where to focus our resources and implement countermeasures (also known as security controls). These "areas to focus on," or threats, are circumstances or events that could cause one of the risks highlighted above to occur.

![Platform](https://images.ctfassets.net/23aumh6u8s0i/3kEf7N3gMeLfxUtIOqqEZP/5a7ee4be2c16df0549cdf2528eb1749e/01_private_cloud.png)

The threat modeling process results in a long list of threats of varying severity. For the purposes of this post, we'll focus on a short list of significant ones:

1. **Employee account takeover**: an attacker compromises or gains access to employee credentials and utilizes them to access Auth0 systems
2. **Malicious insiders**: an internal employee abuses existing authorized access to Auth0 systems 
3. **Service or application compromise**: an attacker gains control of an Auth0 product or platform service, third-party managed service, or a cloud provider service
4. **Software supply chain compromise**: an attacker tampers with or exploits misconfigurations/vulnerabilities in software dependencies used by the Auth0 product or platform

This list of threats informs what secure design patterns and security controls we deploy into the platform's architecture.

## Securing Multi-Cloud Architecture is Hard

Now that we have defined the list of threats we're protecting against (the "what"), we can start determining the design changes, secure design patterns, and security controls that will address those threats (the "how"). But first, before jumping into that, let's take a step back and understand the challenges with securing a platform that utilizes multiple cloud providers. In Auth0's case, we use both Amazon Web Services (AWS) and Microsoft Azure.

### Increased complexity

Using multiple cloud providers increases the architecture's overall complexity. Each cloud provider has similar general capabilities such as computing, networking, storage, and logging. However, each cloud provider implements these capabilities in their own ways. What we end up with are multiple implementations of the same core capability, like virtual machines or blob storage. These nuances between cloud providers introduce complexities that are challenging to secure.

Let's use an example to illustrate these differences. The Auth0 product requires [blob storage](https://auth0.com/blog/azure-storage-introduction/), so let's compare AWS S3 and Azure Storage Accounts and only focus on the different access methods.

![AWS S3 and Azure](https://images.ctfassets.net/23aumh6u8s0i/6DKlibDUAMicDy2oQaUKez/a66838c5086a3e1203d513dc7c3d1eef/table.png)

Another example is AWS Security Groups (SG) vs. Azure Network Security Groups (NSG) and how each handles rule evaluation. AWS SG rules are additive (i.e., allow the superset of all applicable rules), while Azure NSG rules are assigned a priority value and evaluated in that order. These are only two examples of the many differences between AWS and Azure we accounted for in the new platform's architectural design. 

### Larger attack surface

Using multiple clouds means potentially securing multiple, similar services for each cloud provider, e.g., AWS S3 _and_ Azure Storage Accounts. The complexity mentioned above and an increased number of services result in a larger attack surface. Today, for instance, we need to secure two cloud service providers (AWS and Azure), and that means securing two sets of each cloud-specific service required to run Auth0. It also means our Detection and Response team needs to ingest and monitor multiple sets of cloud-specific log sources to properly monitor and investigate the activity. That's a large surface area to secure.

### Cross-cloud connectivity

Communication between services within the same cloud is straightforward. We simply need to use the cloud provider's own mechanisms, and it should "just work." However, there are different points in our new platform's architecture that require some form of communication between AWS and Azure. Network connectivity, for example, needs to be established between Azure Points-of-Presence (PoPs) and Auth0 Central (which runs in AWS). We don't have the ability to use either cloud's PrivateLink service in this scenario (which would be preferred). In another example, Azure Spaces need to upload usage metrics into Auth0 Central (AWS). In single cloud architecture, we could simply use Azure RBAC configured with the proper role assignments. However, that's not possible in this scenario; the Azure Kubernetes Service (AKS) cluster/pod will need to authenticate using AWS S3 authentication methods.

## Addressing Multi-Cloud Challenges

So far, we reviewed the risks Auth0 is most worried about, enumerated a short list of threats to help guide our security decision-making, and discussed some of the challenges Auth0 experienced securing a multi-cloud architecture. Next, let's walk through the principles we applied to determine how we address those threats in the context of those multi-cloud challenges.

### View all security-related decisions through a risk-based and threat-centric lens.

That means all secure design decisions or security controls implemented were directly related to the risk and threats we enumerated during the previous sections. Prioritization is key, and using this lens influences where we need to spend available resources and which countermeasures would be most effective.

### Apply secure design principles and integrate security into the platform early and often. 

The Auth0 Security team is involved throughout the product life cycle, from ideation to design to build to operation and finally to deprecation. We are heavily involved in the design and build phases. This is important because it's easiest to make architectural changes before the technology is built.

### Establish clear, enforceable trust boundaries.

These trust boundaries inform how we implement various countermeasures such as access controls. They also encapsulate areas of risk, making them easier to manage. For example, our development and production environments are completely isolated and separate from one another. Operators cannot use development access to affect any part of the production environment.

### Balance cloud-native and cloud-agnostic capabilities.

This is a tricky one because each has its own benefits and challenges. Cloud-native capabilities (e.g., AWS managed databases) are tightly integrated with the cloud provider, which means you'll get those integrations — like GuardDuty or Microsoft Defender — out-of-the-box. On the other hand, cloud-native services are tightly coupled to their cloud, and deploying them for _both_ AWS and Azure increases the complexity and attack surface (as we discussed above). Compare that to cloud-agnostic capabilities, which can provide a single pattern and enable a simpler architecture with less attack surface. However, integrating with cloud provider services tends to require more work or "glue" to stitch them together. For example, our Auth0 product consists of Kubernetes workloads (cloud agnostic). We use managed Kubernetes services (AKS and EKS), and it's very easy to use the same services across both clouds. That means less complexity (i.e., one change to the Auth0 product will be applied to both clouds) and less attack surface (i.e., one service to secure).

## Selecting the Right Set of Security Capabilities

Finally, let's review the various security capabilities Auth0 implemented into the new platform to address the threats and multi-cloud challenges mentioned above. In addition to our own security capabilities, Auth0 takes advantage of the cloud's shared responsibility model. The shared responsibility model allows us to focus on securing other areas of the platform instead of worrying about the underlying cloud service provider infrastructure.

### Cloud Governance

All Auth0 Spaces, PoPs, Central, and Control Plane technology stacks are isolated into their own AWS Account or Azure Subscription. This provides clean and clear resource isolation, especially for single-tenant Spaces. We used AWS Organizations to create an Organization Unit (OU) hierarchy based on environment and functionality and add each account to a specific OU. We used Azure Management Groups to create a similar hierarchy for Azure Subscriptions. The hierarchies we created enable scalable, granular access controls and policy enforcement; we grant access or apply policies (Azure Policy and AWS Service Control Policies) to specific Management Groups / OUs or Spaces. For AWS, we grant access based on OU conditions and assign SCPs to OUs. For Azure, we assign roles and policies scoped to specific Management Groups. The access and policies are then inherited by the intended accounts or subscriptions.

![Cloud Governance](https://images.ctfassets.net/23aumh6u8s0i/ovvm1JDueXMwiN8ZKQThA/8f1684125fcc76f224b5e9329d5aa0fb/02_private_cloud.png)

### Identity and Access Management

Auth0 was built to secure identities, so we leverage Auth0 + Okta to secure authentication and authorization to our platform tooling. We manage all cloud providers and support application access using a least privileged RBAC model. We also require Multi-factor authentication (MFA) for all operator access to the platform; this includes cloud providers and all supporting applications. Operators are required to use Azure Privileged Identity Management (PIM) - which provides just-in-time access - for any administrative activities. Azure AD Identity Protection identifies and blocks any risky Azure tenant sign-ins.

### Network Security

All single-tenant and multi-tenant Spaces are logically isolated from one another with no interconnectivity between them. This strong isolation drastically reduces an attacker's ability to pivot into other Spaces or PoPs and further their attack. We further restrict inbound connectivity to spaces by using AWS and Azure PrivateLink to connect outbound from Spaces to a PoP. All traffic is encrypted in transit using TLS 1.2+. This includes network traffic between all cloud services, Kubernetes pod-to-pod traffic, and Kubernetes cluster-to-cluster traffic. For some workloads, we utilize mutual TLS (mTLS). On the network edge, we protect against DDoS attacks on our infrastructure, identify and block bots, enforce rate limiting, and block malicious traffic with web application firewall (WAF) rules. Operators must use VPN to access platform infrastructure, adding another layer to our defense-in-depth strategy.

![Network Security](https://images.ctfassets.net/23aumh6u8s0i/2DQcFgwaIkylGFaN479rmz/4a28c57f312f42a25052f84ae788b7b1/03_private_cloud.jpeg)

### Data Protection

All data is encrypted at rest using AES-256 or better, and encryption occurs at multiple layers (e.g., disk, file, database, and application layers). All data in transit is encrypted using TLS 1.2+. Auth0 encrypts platform secrets using HashiCorp Vault and takes full advantage of Azure Key Vault and AWS KMS for encrypting data in cloud services.

![Data Protection](https://images.ctfassets.net/23aumh6u8s0i/1XOTfQ1STNV4y9rTo7FcHf/3fd90c1fd4c3317f63804562e892d5e5/04_private_cloud.png)

### Detection and Response

Auth0 monitors the platform using a combination of cloud services and our own monitoring tools. We take advantage of AWS GuardDuty and Microsoft Defender for Cloud in addition to our own tooling. Auth0 ingests a vast amount of AWS and Azure platform logs for all of the cloud services used by the platform. These logs are ingested into a security data lake and monitored with detections defined as code.

![Detection and Response](https://images.ctfassets.net/23aumh6u8s0i/3aH0JsipzpNkdNubtfYwWN/6123b09fe51ae344fd4537e777081a22/05_private_cloud.png)

### Kubernetes Security

The [4C's of Cloud Native security](https://kubernetes.io/docs/concepts/security/overview/) is a good framework to use when thinking through Kubernetes security. We are, in varying aspects, responsible for security in the clouds we're using, the clusters we're running, the containers running on those clusters, and the code running within the containers. Auth0 uses the managed Kubernetes services Azure Kubernetes Service (AKS) and AWS' Elastic Kubernetes Service (EKS). These offerings from Azure and AWS are security feature-rich. Our worker nodes meet Kubernetes CIS Level 1 Benchmarks. Cluster access is restricted to operators, and least privilege is enforced using specific RBAC roles. We use Kubernetes NetworkPolicy objects to restrict pod network ingress and egress to authorized sources and destinations.

![Kubernetes Security](https://images.ctfassets.net/23aumh6u8s0i/48mIINcAPiqFzHe39D2I53/eeb1592c93f41b01ed465d6abd7bf349/06_private_cloud.png)

### Vulnerability Management

Our build and deploy pipelines continuously scan our cluster, containers, and code for vulnerabilities. Our security capabilities include the usual controls: static application security testing (SAST) on both code and infrastructure-as-code, dynamic application security testing (DAST) on our application and API endpoints, and software composition analysis (SCA) on our software dependencies and containers. Cloud Security Posture Management (CSPM) tooling identifies and responds to cloud misconfigurations (e.g., publicly accessible S3 buckets). Patching is a foundational security control; we continuously upgrade our containers and software dependencies. In the shared responsibility model, Azure/AWS are responsible for building upgraded node images, and Auth0 is responsible for deploying the images to our nodes. We accomplish this by rebuilding our Kubernetes nodes with the latest image during each Auth0 product release cycle.

### Automation is a must

We are dealing with a scale that makes it impossible to configure all of these security capabilities manually. To address his challenge, the Auth0 Security team created an in-house service that automates AWS account and Azure subscription creation and configuration. Similar to a production line, when new Spaces and PoPs are needed, this service creates AWS accounts and Azure subscriptions to meet our strict security standards using predefined templates. It effectively "stamps out" completely configured new accounts/subscriptions on-demand. When the account or subscription is no longer needed, the service will remove all resources, revoke all access, and decommission it.

## Continuously Improving Auth0's Security Posture

All of this work has culminated into a more secure, scalable platform that continues to meet or exceed the many requirements needed to achieve ISO 27001/27018, SOC 2, PCI, STAR, and HIPAA compliance.

The threat landscape is ever-changing and constantly evolving. The Auth0 Security team's job is never done, and a core principle is a continuous improvement. There are always ways to mitigate more risk and enhance our security posture, and we continually investigate additional security capabilities to make our platform and product even more secure for our customers.

We are publishing a series of technical posts on how and why we re-platformed. They'll be linked at the bottom of this post as they publish and are also findable on our blog. If you have technical questions or ideas for future posts, please reach out to us via the [Auth0 Community](https://community.auth0.com/). (Our marketing team also tells us we would be remiss if we didn't include a link to talk to Sales, so that is [here](https://auth0.com/contact-us), too.)

<include src="asides/AboutAuth0" />

Securing Auth0's New Private Cloud Platform

leonardo

Leonardo is a Senior Software Architect at Okta, working on the new Auth0 platform and cutting-edge product features. He is a seasoned technical leader with 17 years of experience in a wide range of segments, from enterprise to SaaS systems. As an Apache committer, he has contributed to various open-source projects. He is a self-learner, passionate about new technology, and has spoken at several developer events.

Senior Software Architect

Leonardo Zanivan

Replatforming to enhance agility, productivity, scalability, reliability, and security.

**TL;DR:** Auth0’s private and public cloud offerings are converging on a single platform to deliver an increase in business agility, developer productivity, scalability, reliability, and security for our customers and Auth0 by using industry-leading tools and fully automated operations.

Initially, Auth0 evolved our public and private cloud offerings as separate platforms because we could go fast and innovate on the public cloud and then work through the greater performance, compliance, and control expected by our private cloud customers. But over time, this led to feature discrepancies and, frankly, just wasn’t that efficient to maintain, scale, or innovate.

So we began an ambitious replatforming project. How could we re-architect all of Auth0 into a single platform? Could we support deployments on both Amazon Web Services (AWS) and Microsoft Azure? What about increasing geo-failover options? And we needed to continue our 99.99% SLA across both public and private clouds.

Let’s not forget that private cloud customers may also require extra add-ons like data residency, private links, and dedicated performance. This post will walk you through our approach to rearchitecting Auth0 to address those challenges.

## The Convergence Starting Point

While both platforms worked exclusively on AWS cloud, the private cloud was not using cloud-native solutions. It had three tiers — Basic, Perf, and Perf+ — available as environment sizes. These were selected based on the number of users and requests per second, versus an elastic scalable public cloud environment shared by multiple customers. The main difference is that private deployment usefully isolated and dedicated resources in any region. In comparison, public deployment uses shared resources for multiple customers in specific regions (United States, Europe, Japan, and Australia).

Our public cloud saw new features delivered on a weekly basis, but due to limited automation, our private cloud required high-touch operations for upgrading to new releases that rolled out on a bi-weekly cadence. 

Requirements for private cloud deployments set it up as a superset of the public cloud offering that already guarantees a 99.99% SLA, with a track record of 99.99+% over the last three years. This was across three availability zones and a geo-failover for regional redundancy and availability.

But we knew we also wanted to include extra add-ons like private links, [PCI compliance](), and meet the customer requests for [Azure Cloud]() support.

## New Cloud-Native Architecture

On a high level, the new cloud-native architecture delivers an increase in business agility, developer productivity, scalability, reliability, and security for our customers and Auth0 by using industry-leading tools and fully automated operations.

It closes the gap between Auth0 public and private deployments by packaging all the product features in a single software version and making them available depending on the customer subscription and add-ons. 

The ideation for the new platform is based on the following premises:

* **Multi-cloud: **AWS and Azure cloud support through a common interface
* **Container orchestrated:** use of container images instead of installing packages
* **Stateless**: scalable and replaceable by design
* **Immutable**: run only trusted code and configuration
* **Fully automated:** provisioning, upgrades, and decommissioning are done by machines
* **GitOps:** enhanced DevOps, push code and safely reproduce it thousands of times  

This removes the worry about the underlying infrastructure, allowing Auth0 developers to place their focus on our customers. This can be represented by the layers in the box below:

![Aplication Layer](https://images.ctfassets.net/23aumh6u8s0i/3yX9TOMT8XC0UPPKK6N57h/41dbdb93833d8c2e20e7c2be1bb445ef/88133_Private_Cloud_Campaign_Auth0.png)

* **Infrastructure layer**: It builds the infrastructure using AWS and Azure cloud services such as networking, virtual machines, key management, load balancers, container repositories, Kubernetes, and managed datastores (Mongo, PostgreSQL, Redis, Kafka).
* **Interface layer**: [Terraform](https://www.terraform.io/) is used for bootstrapping the infrastructure using code on different clouds. [Vault](https://www.vaultproject.io/) is used for platform secrets management and [Kubernetes](https://kubernetes.io/) as de-facto technology for application runtime along with custom plugins to describe services manifest, configuration, and secrets using the platform control plane component. [Argo CD](https://argoproj.github.io/cd/) is a GitOps continuous delivery tool used for applying for new software releases while [Argo Workflows](https://argoproj.github.io/workflows) is used for orchestrating the provisioning, upgrades, and decommissioning steps. This layer also contains integrations and agents for managing service discovery/DNS, logs, metrics, security audit, and datastores.
* **Application layer**: It is where the containers run. The Auth0 Identity Platform is built to allow multiple stacks with different sets of containers deployed accordingly to their usage. Auth0 products, PoP, Control Plane, and Central Services use a promotion pipeline for validating new releases and configurable release schedules. Everything is managed by control plane API and developers interact with the new platform CLI or Hub (web interface). One might wonder how identity is managed to access Kubernetes resources, it uses [Pomerium with Auth0 Identity Provider](https://www.pomerium.com/docs/identity-providers/auth0.html), dogfooding our own product.

Before we go deep into the technical details, the blog [A Primer on the New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) provides more details about the Space, PoP, Control Plane and Central components of the new platform.

## The Components—A Ten Thousand Foot View

The diagram below demonstrates the main components of the platform and its links, including data flows and cloud regions. Internal services and network details are omitted.

![The Components—A Ten Thousand Foot View](https://images.ctfassets.net/23aumh6u8s0i/2bmBmIoidTViCeyw2dInNB/26a1c8a5cd9ac8a556488585edbb35d4/Arquitecture.png)

**Edge Network**: The global network provider, used by Auth0 for DNS, edge computing, CDN, DDoS protection, web application firewall, custom domain certificates, and speed-up end-user experience.

**Space**: Customer environment containing the dedicated application and datastores resources, deployed in any cloud region, maintaining security and data residency through tight access control for operators. Datastores use dedicated private networks isolated from the applications. New application deployments spin a whole new application cluster containing the new version and then slowly switch the traffic using a 'canary deployment' strategy. In addition to that, 'Data Shield' component is responsible for receiving a variety of data such as application logs and then scrubbing it, removing any PII or sensitive information. Only the clean logs are ingested and clean data is forwarded to Auth0 data analytics and detection & response teams for monitoring the system. The customer data never leaves the cloud region (e.g. Azure EastUS).

**PoP**: Point of presence of the platform in a given cloud region (same as the Space), required to host the container registry of software stacks used by the Kubernetes cluster. This component runs a set of shared services to support the platform, including the OpenSearch stack used by operation engineers to troubleshoot issues. It also runs regional services, shared between Spaces to support platform operations, such as forwarding data analytics, and internal Auth0 system supporting services requiring low network latency for fulfilling requests. It is important to note though that PoP doesn't have access to the Spaces network, it acts as a regional endpoint.

**Central & Control Plane**: A region in the European Union (EU) where the control plane services are deployed. They are internal to Auth0 operators and are used to interact with the customer Spaces and PoPs. It is secured by Zero Trust model and manages platform secrets and metadata using Terraform, Vault, and Argo. In addition to the control plane services, the central component is also designed to run other completely isolated application stacks to host global services accessible by customers and support engineers.

**Auth0**: The analytics aggregated data is sent to Auth0 headquarters and other global systems such as DataDog and Snowflake to be consumed by internal teams in many different departments, such as business analytics, customer support, and engineering teams. The data is categorized into different levels of access and doesn't identify any customer-sensitive information such as personally identifiable information (PII). The Detection & Response team is an exception and runs security software to analyze production traffic and usage patterns to actively detect & mitigate attacks.

## High Availability and Geo-failover

Auth0 guarantees a 99.99% SLA for production deployments. On a high level, the infrastructure is fully redundant, and all components are deployed into multiple availability zones, using at least 3 availability zones (AZ) combined primary and secondary regions, either in clustered mode or standby replicas. 

For web applications, the traffic is distributed across multiple Kubernetes nodes using load balancing. For datastores, Mongo and PostgreSQL are considered the system of record, i.e. the authoritative source of data, deployed in the primary region with a writer and at least a reader node for splitting write/read traffic and replicating the data to a secondary (failover) region in real-time. The caching (Redis) and stream (Kafka) components are deployed using sharding and failover capabilities, always providing high availability for runtime and data.

As for central services, control plane, and PoPs, they also run on high availability infrastructure and have the ability to failover, while this process is executing or in case of temporary or permanent network connectivity issues, the Spaces continue functioning as expected without any disruption. Spaces are isolated from each other and are fault-tolerant to other tiers' failures. 

The geo-failover is a fully automated process and is manually triggered by an operator during incident response for disaster recovery in case a cloud region is fully or partially unavailable. The process redirects all the traffic to the secondary region (determined by the customer) which switches the DNS of the cluster ingress and promotes the secondary region replicas to become the primary writer; there's no dependency on the primary region for the disaster recovery to successfully execute. 

The target RPO (Recovery Point Objective) is less than a minute, the time period in which data and events can be lost due to the disaster recovery procedure. At the same time, the RTO (Recovery Time Objective) is less than 15 minutes for the amount of downtime tolerated during the disaster recovery process.

The process of failback (revert the failover) from the secondary to the primary region is the same and can be triggered once the situation resolves.

The diagram below shows the Auth0 deployment containing a primary and a secondary warm standby region with high available datastores, and for simplifying purposes other AZs running only applications are omitted:

![Azure servers](https://images.ctfassets.net/23aumh6u8s0i/7f96vQ2UJukSjYJYc5flNt/a406ca7bac6ad54dc5e2bfc75c754dd8/Azure_servers.png)

We are publishing a series of technical posts on how and why we replatformed. They’ll be linked at the bottom of this post as they publish and are also findable on our blog. If you have technical questions or ideas for future posts, please reach out to us via the [Auth0 Community](https://community.auth0.com/). (Our marketing team also tells us we would be remiss if we didn’t include a link to talk to Sales so that is [here](https://auth0.com/contact-us), too.)

The Architect’s View of Auth0’s New Private Cloud Platform

Marketplace partner Spruce has expanded the Auth0 platform to use web3 wallets as an identity source.

Thanks to the hard work of [Spruce](https://www.spruceid.com/), following their [announcement on March 8th](https://blog.spruceid.com/spruce-developer-update-17/), you can now add Sign-in with Ethereum to your Auth0 tenant via their [marketplace integration](https://marketplace.auth0.com/integrations/siwe). While the debate rages on the value of cryptocurrencies, non-fungible tokens (NFTs), and decentralized autonomous organizations (DAOs), it’s clear that Web3 technologies have the potential to change the way we authenticate. The [Auth0 Lab team](https://twitter.com/Auth0Lab) has been [following Web3 developments closely](https://twitter.com/Auth0Lab/status/1501984403773394946?s=20&t=_wTmCWDZR0kQifVURed70Q), and we’re excited to promote this new capability in Auth0.

## Adoption 

<img src="https://images.ctfassets.net/23aumh6u8s0i/oPVdQLjdTS63FS60ODRzA/3892e933900b03cf12060cbdb9c34a9a/Uploaded_from_Sign_in_with_Ethereum" align="right" alt="Adoption" width="450" /> At the end of 2021, [crypto.com](http://crypto.com/) estimated that [300 million people](https://assets.ctfassets.net/hfgyig42jimx/5i8TeN1QYJDjn82pSuZB5S/85c7c9393f3ee67e456ec780f9bf11e3/Cryptodotcom_Crypto_Market_Sizing_Jan2022.pdf) own some form of cryptocurrency. That means those 300 million crypto users (as well as new ones) need a wallet to hold the private keys allowing them to access their currency. 

Diving in, [71 million of those cryptos](https://decrypt.co/89486/number-of-non-zero-ethereum-addresses-record-high-71-million-glassnode) wallets hold Ethereum. This massive adoption has led to an ecosystem of tools to help users leverage the [private keys in their wallets](https://developer.bitcoin.org/devguide/wallets.html) for more than just blockchain transactions. 

While many users lean on [Metamask](https://metamask.io/) for [non-custodial software wallets](https://www.bitcoin.com/get-started/custodial-non-custodial-bitcoin-wallets/) and a gateway for interacting with [Web3 DApps](https://ethereum.org/en/developers/docs/dapps/), other options are gaining market share. [Portis](https://www.portis.io/) and [Torus](https://toruswallet.io/) are other non-custodial wallet competitors.

 

[Coinbase](https://www.coinbase.com/) is a popular cryptocurrency exchange that creates [custodial wallets](https://www.coindesk.com/learn/custodial-wallets-vs-non-custodial-crypto-wallets/) on behalf of users to hold on to their cryptocurrencies. [With 89+ million verified users](https://www.coinbase.com/about#:~:text=Coinbase%20powers%20the%20cryptoeconomy,%2C%20earn%2C%20and%20use%20crypto.), it’s quickly becoming a trusted option. [Fortmatic](https://fortmatic.com/) is a custodial wallet just for authentication and gives users access to their private key with a traditional email/password flow that users recognize in web2.


[WalletConnect](https://walletconnect.com/) is both a standard and a set of SDKs that help any app connect to any type of Web3 wallet. With over 160 apps listed in its registry, it’s becoming a popular way for developers to get access to users’ wallets.

Transactions on the Ethereum blockchain are also increasingly getting easier to conduct courtesy of tools like the [Ethereum Name Service (ENS)](https://ens.domains/), which, similar to DNS, maps a unique human-readable name to the underlying machine-readable strings assigned to each wallet/account. This name can be used instead of the public key, and many apps know to find the address by looking at the ENS smart contract with a registry of the associated addresses. [With 300k+ users](https://ens.domains/#home-statistics), ENS is a growing trend in the Web3 community that makes it easier for the average person to work with their key.

## Sign-in with Ethereum (SIWE)

Ethereum, along with other blockchains that allow for “[smart contracts](https://ethereum.org/en/developers/docs/smart-contracts/)”, allow for additional authentication data to be stored on the blockchain. Non-fungible tokens (NFTs) are already being used to grant access to things like [web communities](https://thirdweb.gitbook.io/thirdweb/guides/membership-nft-for-discord), [restaurants](https://coinyuppie.com/empowering-the-membership-club-model-analyzing-the-worlds-first-nft-restaurant/), and [events](https://cointelegraph.com/news/showtime-nft-tickets-take-the-stage-in-2022-connecting-artists-and-fans). When our [Auth0 Lab team](https://twitter.com/Auth0Lab) started looking into Web3 technologies, we realized that smart contracts could be used to store data for [JWT claims](https://jwt.io/introduction), [verifiable credentials](https://en.wikipedia.org/wiki/Verifiable_credentials), and other authorization data. All that’s needed is a signature by the private key to prove the user’s ownership of those rights.

In early December 2021, the Auth0 Lab [released a demo](https://twitter.com/Auth0Lab/status/1468974610058137604?s=20&t=6GJfq6iCeKQ_vhonsCgNSw) of what this could look like using Auth0. It quickly [got the attention](https://twitter.com/metamask/status/1471177244450111498?lang=en) of Web3 organizations like Metamask and led to a jump into the [Auth0 Lab Discord membership](https://discord.gg/xkbkz9rZcD), a community open to anyone interested in discussing Auth0 Lab initiatives with the team. 

[Spruce](http://www.spruceid.com/), which builds decentralized identity tooling and [self-sovereign user data storage](https://www.spruceid.com/kepler) for Web3 users and organizations, released a [sign-in with Ethereum (SIWE) integration](https://marketplace.auth0.com/integrations/siwe) on the Auth0 marketplace. Now any Auth0 client can leverage SIWE in their applications.

![Spruce](https://images.ctfassets.net/23aumh6u8s0i/7qt8yG4BuFlFw5zshSeoVt/f1bd2e1300fa06af4d4d92f0e4625637/Uploaded_from_Sign_in_with_Ethereum)

This activity diagram shows how the oidc.login.xyz server can facilitate authentication. The website in this diagram is an Auth0 application. Like with any OIDC server, Auth0 can augment the data from any additional sources and help manage the JWT. It’s a great way to quickly plug your existing Auth0 application into the growing Web3 user base.

Currently, Metamask, WalletConnect, Fortmatic, Torus, and Coinbase are all supported in the integration.

## Adding Sign in With Ethereum to Your Tenant

It only takes minutes to add sign in with Ethereum to your Auth0 tenant! 

<AmpContent>
<amp-youtube
 data-videoid="AUC0L7ATsOc"
 layout="responsive"
 width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/AUC0L7ATsOc' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

### Step One: Add the Integration from the Marketplace

From [https://marketplace.auth0.com/integrations/siwe](https://marketplace.auth0.com/integrations/siwe), with a simple click of “Add Integration” and a quick selection of which tenant you’d like to add the integration to, you can get started with your setup.

![Step One](https://images.ctfassets.net/23aumh6u8s0i/5sEgcSRNSFANYAdz2dHD9Q/9eb81092329c05bf9e40cdf9a8d50bcb/Uploaded_from_Sign_in_with_Ethereum)

### Step Two: Obtain a Client ID and Secret

Obtain a Client ID and secret, this can be done with a simple CURL command:

```
curl -X POST https://oidc.login.xyz/register -d '{"redirect_uris":["https://YOUR_AUTH0_DOMAIN/login/callback"]}'
```

![Step Two](https://images.ctfassets.net/23aumh6u8s0i/6qu6mdHY7AEPtn146hdscW/aae8d0fe17316defe591973784a743e9/Uploaded_from_Sign_in_with_Ethereum)

### Step Three: Create the New Social Connection

Login to the Auth0 tenant you selected in Step One and head over to your social connections. A sign-in with Ethereum connection will be on the list:

![Step Three](https://images.ctfassets.net/23aumh6u8s0i/06A8NyYZB1me1aUoQNsHk/8e7710042f874be484e70b3da1a30b9f/Uploaded_from_Sign_in_with_Ethereum)

### Step Four: Configure the Social Connection

Accept the access request by clicking “Continue”, and add your Client ID from Step Two. If your application is a[ Confidential Application](https://auth0.com/docs/get-started/applications/confidential-and-public-applications), add the Client Secret. 

![Step Four](https://images.ctfassets.net/23aumh6u8s0i/34XGbspkzKnoq9HCNZZHmh/cb71bc313c862877fdab1145b57b1852/Uploaded_from_Sign_in_with_Ethereum)

### Step Five: Enable the Connection on Your Application

Finally, toggle the connection to on for the application you’re trying to add it to:

![Step Five](https://images.ctfassets.net/23aumh6u8s0i/32ac6TFbbxiXFOgL0kGyDE/63304bbfa56209f8d2507c979e636ca3/Uploaded_from_Sign_in_with_Ethereum)

That’s it! If you need additional help, review the installation instructions on the [integration marketplace page](https://marketplace.auth0.com/integrations/siwe), and you can always join the [Spruce discord server](https://discord.gg/Sf9tSFzrnt).

## Future Plans for Sign-in with Ethereum

Sign-in with Ethereum (SIWE) [is an open standard](https://eips.ethereum.org/EIPS/eip-4361), led by Spruce with support from the Ethereum Foundation and ENS. It was built [in public](https://login.xyz/) over a number of months with the input of security experts, Ethereum community members, and Web3 projects. Spruce will continue to support their existing work on [numerous libraries for direct integration](https://docs.login.xyz/) and their OpenID Connect Identity Provider Server, which is also [open source](https://github.com/spruceid/siwe-oidc).

## What’s Next?

The Auth0 Lab team is deeply invested in exploring Web3 identity potential. You can follow our progress on [Twitter](https://twitter.com/auth0lab). If you’re interested in speaking with the team, join our discord and start a [thread](https://discord.gg/xkbkz9rZcD).

The Auth0 Lab team is working on demo features and apps that will show the potential of Web3 identity for Web2 and Web3 orgs alike. We look forward to sharing our experiments, working with you, learning from you, and building awesome things together.

The [Auth0 Marketplace](https://marketplace.auth0.com/) is always looking for partners to build new extensions onto Auth0. Visit [https://auth0.com/integrate](https://auth0.com/integrate) to learn more.

Sign In With Ethereum (SIWE), Now Available on Auth0

Our commitment to delivering a Tier 0 service for our customers

Resiliency, reliability, and adaptability are foundational tenets to how we build at Auth0. Last year, we recognized the need to deliberately double down on our resilience efforts in order to address some of the failures we had seen. In November 2021, I wrote about our [plans to improve the resilience of our platform](https://auth0.com/blog/improving-our-platform-resiliency-and-upcoming-holiday-plans/) and the additional steps we were taking to address the peak holiday traffic. I’m proud of the hard work and diligence by our teams during the holiday season that moved us considerably towards our goal of providing a Tier 0 service. Today, I want to provide updates to that work, share the progress to date, as well as provide insight into our upcoming efforts.

## Update on Our Resiliency Focus Areas to Date

As a reminder, a big focus area for our team was to reduce the load on our datastores. We made significant progress in this area:  

*   Reduced the database read/write workload by 50%. Our initial target was a 10% reduction, so we greatly surpassed our initial estimates
*   Reduced 45% of inserts/deletes from our database in US-1, 50% in EU, and 20% in the rest of our environments. The team's initial target was 40% in US-1 so we also beat this estimate

We also actioned all the initially identified resiliency priorities. These were all implemented either prior to the Thanksgiving holiday in the US or in early December:  

*   Added noisy neighbor protection for our extensibility stack (Webtask)
*   Expanded our caching approach for common Authentication API requests
*   Enforced new Auth API global rate limits for all production tenants
*   Enforced 100 RPS for non-production enterprise tenants
*   Refactored our connections schema and deleted unused entries/rows; in US-1, we reduced the table size by ~25X.
*   Overprovisioning of our stack was done in anticipation of holiday traffic, we’ve since downsized based on usage data and some of the other protections put into place

While we made great progress on our improvement initiatives, I want to acknowledge that in December we experienced a few issues related to our network edge, which caused unfortunate customer impact. We have met with our network edge provider to ensure our expectations around incident response and service levels are understood and upheld. We’ve also initiated a new internal effort to review our Edge resiliency plan and kicked off the discovery work. We’ll provide further updates as we make meaningful progress on this effort.

## What’s Next in 2022

Resiliency has been and remains a top priority for Auth0 in 2022. The work that I outlined above has laid strong foundations that will serve as a springboard for our ongoing priorities. Below are a few key highlights of what to expect this year.

### New Environments
This is one of our top priorities for the first half of 2022. Construction efforts have kicked off for three new production environments that will enable us to shift load as required for our demand response strategies and limit the blast radius of disruptions and outages. These environments will be launched in 1H 2022 and will feature two new options in the US and one in the EU.

### Automated Tenant Migration Process

In addition to new environments, our team has been working on our capabilities to move tenants from one environment to another in order to further reduce the blast radius. The early design work began in Q3 2021, with a focus on high-touch migration of select targeted customers based on feature usage, workload, and configuration. As we iterate and learn from that effort, we will shape up our tenant migration process from “high-touch”/manual intensive to a more automated process.

### New Platform Rollout

We are laser-focused on our platform modernization efforts which have an underlying architecture that is responsive and resilient to meet all current and anticipated customer needs. The new platform is already powering our product that [launched on MS Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) in November 2021. I will share details about the availability of this new platform on AWS as we get closer to launch in Q1 2022.

Thank you for the continued trust that you place in Auth0 to meet your identity needs. We have exciting things in the works that will enable us to continue our delivery of a Tier 0 service with all of the product innovation you have come to rely on for your applications.

A Look Back to Our Platform Resiliency and What’s Next

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Extensible building platform for customizable identity enables enterprises to adapt to any current and future need.

**BELLEVUE, Wash. – May 12, 2021 –** [Auth0](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced the Auth0 Identity Platform, a cloud-native, adaptable platform for development teams. Built with extensible building blocks, the Auth0 Identity Platform enables organizations to manage the complexities of today’s identity management while also prioritizing the security, privacy, and convenience of their end users. 

Striking the perfect balance among these priorities requires identity to integrate a myriad of different services and creates a significant integration hurdle. Identity ecosystem operators can now manage these complex integration needs with the flexibility of full spectrum code (pro-code, low-code, and no code solutions). Customizing to the requirements of different development teams removes their need to focus on identity infrastructure when building differentiated applications. This level of adaptability is a huge benefit for enterprises that are confronted with converging use cases and managing the eroding lines between identity for employees, business partners, and consumers. 

New features that support this adaptability are: 

* **[Auth0 Actions](https://auth0.com/actions)**: An extensibility framework that executes serverless functions on triggers in a highly configurable way to meet the unique needs of each developer. Auth0 Actions offers more tooling and an improved experience to easily extend and customize Auth0, providing development teams with the ability to solve identity problems more quickly.
* **[Auth0 Organizations](https://auth0.com/organizations)**: An enhanced way for enterprise app teams to manage customers and partners in any multi-tenant, B2B, or SaaS application. With Auth0 Organizations, B2B implementations are less complex, enabling faster speed-to-market and a better overall experience for Business Customer Identity use cases. 
* **[Auth0 Identity Maturity Framework (IMF)](https://auth0.com/imf-form)**: An Auth0 tool that visualizes a customer’s entire identity journey. Developed in collaboration with Auth0’s largest customers, the Auth0 Identity Maturity Framework provides a toolkit to benchmark current identity maturity, create a plan for an organization’s identity journey, and visualize how the Auth0 Identity Platform can identify and move practices from good to great.

 

“We believe the companies that succeed in the next five years will not only meet but exceed the ever-growing expectations for security, privacy, and convenience,” said Shiv Ramji, Chief Product Officer at Auth0. “Traditional identity platforms are inflexible to customization, which makes exceeding these expectations nearly impossible. The modern identity platform of the future — the Auth0 Identity Platform — is adaptable. An integration bridge, a bridge between use cases, and a bridge for user experience is now critical for accelerating an enterprise’s scale and growth.” 

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), believes in solving the breadth of identity needs for every customer and end user. The Auth0 Identity Platform can be the powerhouse of an identity cloud, driving any combination of policies, configurations, full-spectrum code, APIs, and protocols to flexibly address any use case.

Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) for more details on its capabilities and how its differentiated adaptability can help enterprises better prepare for the future. 

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Offers Ultimate Flexibility in Identity Management

What's new in .NET 6? What are the main relevant features brought by the new version of the .NET platform? Let's take a quick look.

With the release of .NET 6, Microsoft consolidates its plan to create a unified platform to develop applications for any device and operating system. Together with this vision, .NET 6 brings many new features aiming to simplify development and gain performance. Let's take a quick look at the main points.

## Unified Platform Support
The vision of a [unified platform for the .NET world started with .NET 5](https://auth0.com/blog/dotnet-5-whats-new/). That release was meant to be the unified successor of [the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono](https://auth0.com/blog/navigating-dotnet-maze/), etc. Beyond this goal, .NET 5 wanted to be a development platform to create any kind of application for any platform. However, at that time, an important piece was missing to complete the puzzle: a unified framework to create cross-platform UIs. Now, with [.NET MAUI](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), i.e., the **.NET Multi-platform App UI** framework, the puzzle is complete. Although at the time of writing [.NET MAUI is in preview](https://devblogs.microsoft.com/dotnet/announcing-net-maui-preview-10/), it is mature enough to be considered part of the .NET 6 release.

Now with .NET 6, you can really create the application you want and run it practically everywhere: from desktop to mobile, from the web to the cloud.

![.NET 6 unified platform](https://images.ctfassets.net/23aumh6u8s0i/GOa5gfL6LckpRRhqaBRJe/69341464075cbd46cf88fcbe36af4aa5/dotnet-unified-platform.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]


In particular, the new [.NET MAUI](https://github.com/dotnet/maui) framework allows you to build desktop and mobile native user interfaces with a single codebase.

![.NET MAUI overview](https://images.ctfassets.net/23aumh6u8s0i/4WkvXpMRwu7j5T82HiW04A/069649d85ea4e1def0831672b5fc8698/dotnet-maui-overview.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]


## Simplified Development
One of the main goals of the .NET 6 release is to provide developers with features that simplify their work. You can find support for simplified development throughout the platform, but three contexts are really exciting: new C# features, Hot Reload support, and minimal web APIs.

### C# 10 features
.NET 6 brings you [C# 10 with plenty of new features](https://devblogs.microsoft.com/dotnet/welcome-to-csharp-10/) that help you write code more easily. Let's take a quick look at a few of them.

#### Global and implicit usings

As a C# developer, you know how annoying it is to declare the same namespace in every file of your project. Consider, for example, the `System` namespace. Its use is very common, and I'm pretty sure you forget it all the time and let Visual Studio suggest it.

Now you can declare namespaces using a global `using`, as shown in the following example:

```csharp
global using System;
```

With this declaration, you don't need to insert the `using System;` declaration in all files anymore. You can declare a namespace through `global using` in any file, and it will be available in the entire project.

If you prefer (and I think it's a good practice), you can declare your namespaces in a file named `GlobalUsings.cs`.

You can also take advantage of implicit `using`s by configuring the `<ImplicitUsings>` element in your `.csproj` file, as shown below:

```xml
<PropertyGroup>
 
 <ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>
```

This way, the compiler will automatically add the required `global using` directives based on the type of your project.

#### New namespace syntax

You know that the usual way to declare a namespace is as follows:

```csharp
namespace Geometry
{
 class Triangle 
 {
 // ...class members...
 }
}
```

Now you can use the file-scoped namespace syntax to get the same result:

```csharp
namespace Geometry

class Triangle 
{
 // ...class members...
}
```

With this approach, everything you define in the current file belongs to the declared namespace. By removing a nesting level, you make the code a bit cleaner. However, you can't create nested namespaces with this new syntax.

#### Natural types for lambda expressions

Consider the following assignment of a lambda expression to a variable:

```csharp
Func<string, int> parse = (string s) => int.Parse(s);
```

You need to declare the target type of the lambda expression, `Func<string, int>` in the example. Starting with C# 10, you can write the above code as follows:

```csharp
var parse = (string s) => int.Parse(s);
```

The compiler will try to infer the "natural" type of the lambda expression.

### Hot Reload
To improve the developer's productivity, .NET 6 extends [the Hot Reload feature](https://devblogs.microsoft.com/dotnet/announcing-net-6/#hot-reload) to Visual Studio and almost any type of project. It allows you to run an application in your development environment, make changes, and get the changes applied without stopping, rebuilding, and rerunning the application.

In previous .NET releases, this feature was available just for the .NET CLI via the `dotnet watch` command. Not without [some minor hiccups with the community](https://www.theverge.com/2021/10/22/22740701/microsoft-dotnet-hot-reload-removal-decision-open-source), you can now benefit from it in [Visual Studio 2022](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/#improved-user-experience-in-visual-studio-2022) as well by simply clicking a button:

![Visual Studio 2022 Hot Reload button](https://images.ctfassets.net/23aumh6u8s0i/3wu09sA8C4IQ5uKfmGoITK/e13d618f3f497e72281665de780b472d/vs2022-hot-reload-button.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/update-on-net-hot-reload-progress-and-visual-studio-2022-highlights/)]


### Minimal web APIs
One astonishing feature introduced by .NET 6 to simplify your code is [minimal web APIs](https://docs.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis). Along the lines of top-level statements, now you can build a fully working web API application with a few lines of code. Consider the following sample:

```csharp
//Program.cs
var app = WebApplication.CreateBuilder(args).Build();

app.MapGet("/", () => "Hello World!");
app.Run();
```

This is all the code you need to run a simple *Hello World!* web API.

If you have some experience building web APIs with ASP.NET Core, you know that you usually need a more articulate project. You need at least a `Program.cs` file with the setup code for the application, a `Startup.cs` file where you configure your API, and a controller class defining the API routes and implementing the endpoints.

That's a lot of simplification!

## Performance Improvements
In the last years, the .NET team put a lot of effort into improving the platform performance in compiling and execution time and reducing memory consumption. With .NET 6, you can appreciate these improvements in many parts of the framework. For example, the effort to [improve inner-loop performance](https://github.com/dotnet/core/issues/5510) in building .NET projects has given awesome results, as you can see from the following diagram:

![dotnet6-build-improvements](https://images.ctfassets.net/23aumh6u8s0i/2ZVS4o4DKc6OroBO0Lb76b/187a5cbf18d934d9a1cefae71f1535f5/dotnet6-build-improvements.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6-preview-2/)]


Other performance improvements include the IO subsystem. For example, the `FileStream` class [was almost completely rewritten](https://devblogs.microsoft.com/dotnet/file-io-improvements-in-dotnet-6/) with amazing results even with respect to .NET 5, as the following table summarizes for the writing operation:

![FileStream performance improvement](https://images.ctfassets.net/23aumh6u8s0i/6RgFjbKytdIQk6pHtEaHxT/1d524bb8a02e4688979d71f3151aef3f/filestream-performance-improvement.png)


[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/announcing-net-6/)]

You can check out [a detailed report on performance improvements in .NET 6](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-6/) with related benchmarks for more information.

## Summary

This quick overview of .NET 6 shows that this is a consolidation release of the .NET platform. It aims to complete the unified platform vision started with .NET 5, improves the internals of the platform to provide the best performance, and starts a process of development simplification that probably will go further in future releases.

<include src="asides/DotNetCore" />

.NET 6 Highlights

david-telehowski

David Telehowski is Director of Security Engineering at Auth0 and his team is responsible for securing the Auth0 Identity Platform. He has over 20 years of experience designing and building innovative cybersecurity products and services. Prior to joining Auth0 David led global engineering teams at SonicWall and Dell, and he has been awarded several patents in the areas of remote access and network security. David holds bachelor's and master's degrees in computer engineering from the University of Michigan.

Director, Security Engineering

David Telehowski

How we expanded customer choice while building a security-first architecture.

Choice is good. We like it when our supermarket shelves are stocked with hundreds of varieties of breakfast cereal. We pick the smartphones we use and the cars we drive. The same should be true for businesses and the technologies they use.

Today, we brought the Auth0 Identity Platform to Microsoft Azure, giving our private cloud customers the ability to pick the right infrastructure provider for their needs.

This means a greater selection of regions. Microsoft currently operates in over 60 regions around the world, making it easier to comply with data residency and sovereignty requirements.

And if you’re already running your app on Azure’s cloud servers, you’ll benefit from a converged infrastructure, with every component running on the same underlying cloud platform.

![Azure](https://images.ctfassets.net/23aumh6u8s0i/3LjSNS6Motv1nFGNKkIQn/3f9353b41dd9653536e2e9b9f664689a/72798-Auth0_AzureMap-D2-02-01.jpg)

## Shifting Security Left on Microsoft Azure

We’re equally excited to tell you about the development process. Auth0 has always prioritized security. Last year, we took this a step further with the adoption of “Shift-Left” principles. This puts security-related tasks at the start of the Software Development Life Cycle (SDLC), making it easier to build a stronger, more resilient product.

We remained true to these principles when building the Auth0 Identity Platform for Microsoft Azure, and are thrilled with the end result. The final product is one that reflects our **Secure by Design** philosophy and faithfully adheres to industry best practices.

Let’s talk about what “Shift-Left” means. This is an established term in the software development sphere, and refers to a variety of domains, both security-related and otherwise. In short, you take something that would typically happen at the end of the development lifecycle and tackle it at the beginning. Test-driven development (TDD) is a notable example.

As Auth0’s CISO Jameeka Aaron said: “Nobody wants their CISO to show up at the last minute with 800 vulnerabilities to be fixed before release.” Our security engineering team looks for vulnerabilities during the design and development phases, and remediates issues early on to prevent a last-minute crunch, or worse, having to rework the design.

At Auth0, our Shift-Left process tackles both the human and technical elements of secure software development. All code must meet strict security requirements and is constantly tested against sophisticated static analysis benchmarks.

We also provide all developers with secure coding training, with some designated as “security champions.” These employees act as liaisons between the engineering and our dedicated platform security teams. They also receive additional training to act as security advocates within their teams.

## Security First Architecture

As we developed the Auth0 Identity Platform for Microsoft Azure, we emphasized “shift-left” principles and focused on building a strong security architecture at the start of the development cycle.

We established a dedicated Azure AD tenant and automated governance controls to support resource and identity isolation, required MFA and Azure PIM for privileged access, and enforced security standards with Azure Policy. Prioritizing security in the early stages of the development process is part of our Secure by Design strategy to mitigate risk and keep customers safe from cyberthreats.

The Security Engineering team is also responsible for Azure customer account provisioning and management. In Azure, these are called subscriptions. These are used to isolate private cloud environments and all the associated provisioned resources, like VMs, data storage, and more.

We built a new service for managing Azure subscriptions, and it is integrated directly into our platform infrastructure workflows. This helped to automate how we manage our Azure Private Cloud environments and dramatically improved environment creation time. This was another part of our Azure governance to keep customer environments isolated and secure.

## Cloudflare on the Edge

To help protect against network-based attacks, the Auth0 Identity Platform uses Cloudflare — a popular reverse proxy and content delivery network (CDN) product.

Cloudflare acts as a gateway between the application and the outside world. The service proactively analyzes all inbound traffic, and blocks things that could harm the smooth functioning of the Azure instance, including malicious bots and DDoS attacks. Further protection comes from its customizable rate limiting and firewall rules.

This means a better, more reliable service for your users. It also comes with some significant performance advantages, too. With Cloudflare's CDN, static assets (like images and scripts) are hosted close to the user, thereby reducing load times. Traffic is routed through Cloudflare's Anycast network, which consists of over 250 locations in 100 countries, and provides greater resiliency and latencies below 50ms.

## Detection & Response

In the hands of an IT engineer, security professional, or developer, logs are a powerful tool. They're the first place you look when remediating a fiendishly tricky problem, or trying to identify an attempted intrusion.

When building the Auth0 Identity Platform for Microsoft Azure, we wanted to make it easy to audit and monitor. Logging is enabled by default on all Azure instances, as well as with the back-end databases. By default, we retain logs for 13 months.

Each Azure environment is covered by Auth0's host monitoring agents. This monitors the security, performance, configuration and state of each host. We also enabled Azure Security Center & Defender by default, further bolstering our security monitoring capabilities.

## Disaster Recovery

Identity is fundamental to business. Your CIAM system is the gateway between your application and its users. You can’t afford significant downtime. With this in mind, we spent a lot of time thinking about resilience when designing the Auth0 Identity Platform for Microsoft Azure.

All services are provisioned across three Availability Zones (AZ). In the case of an AZ failure, service are designed to automatically resume in one of the other healthy AZs. Backups are captured every six hours and securely retained in the same region as the deployment, and we can restore an instance from the last snapshot in four hours.

## Azure’s Solid Foundations

Let’s wrap up by talking about Microsoft Azure itself. After all, what’s the point in building a secure platform if the underlying infrastructure isn’t up to standard?

Fortunately, there’s no such concerns here. We have come to appreciate the security features and tools within the underlying Azure platform and ecosystem. Microsoft also has the right mindset. The Azure access control best practices urge users to regard identity as the primary security perimeter. This reflects the changes in enterprise IT, particularly the rise of BYOD and cloud computing, which make it harder to build watertight network defenses.

Identity is the best way to protect your most important data. Well-defined permissions can limit the impact of a security breach, while using MFA and SSO can help prevent an account being compromised in the first place. To find out how the Auth0 Identity Platform on Microsoft Azure can benefit your organization, [click here](https://auth0.com/contact-us).

Why Auth0 “Shifted Left” with Azure

We are committed to delivering a Tier 0 service for our customers

Over the last few months, there has been an increase in service degradation and outages that has shaken our customer’s confidence in Auth0. Our number one mission is to provide you with the highest level of service and reliability at all times, for the full spectrum of customers from free users to enterprise. The production environments in US-1 and EU have been impacted the most frequently and, in extreme cases, has caused downtime for some of our customers. As the Auth0 CPO, I sincerely apologize for the pain this caused you and your customers. We take ownership for the failures and recognize how disappointed you are.

We know that identity plays a critical role in your company, and it is our responsibility to make our service reliable. It is also our responsibility to provide guidance to our customers on appropriate architecture patterns. When we experience failures or degradation of our service, we correct them as swiftly as possible. Today, I wanted to share the active measures we are taking to protect against similar issues from occurring in the future.

## First, What Caused the Outages?

Before we explore all of the actions we have taken, it’s good to understand the patterns we have observed in these environments:

### Noisy neighbors in our large multi-tenant environments create throughput bottlenecks

The noisy neighbor phenomenon is a well-known issue in multi-tenant environments. In our case, one co-tenant may experience a spike in traffic which can lead them to monopolize resources available and thus reduce the throughput (requests-per-second) on the environment for the other co-tenants.

Most of our customers in the US-1 and EU environments have enjoyed many years of uninterrupted service. These environments have grown significantly and are now the longest-running and largest, which exacerbates the noisy neighbor impact.

We have not strictly enforced restrictions to the frequency of customer API calls (rate limits) and at times allowed for a 10X increase in requests-per-second (RPS) for certain tenants in a single environment. Typically, our architecture would allow us to absorb these spikes as it is the case in most of our environments, but given the volume and size of the customers in US-1 and EU, these concurrent requests restrict throughput for other tenants. We do not fault our customers for their peak traffic needs and it is on us to put in place the right protections and guardrails around each tenant. Unfortunately, we are not able to actively load shed today (i.e. automatically move tenants to other environments such as US-3, because we don’t currently have the migration tooling nor can we do it without any downtime). There are some customer scenarios where a planned migration by a customer is possible, but it requires time and effort on your part. I will cover migration scenarios and timing in the ‘Looking beyond the next 60 days’ section below.

### Region Mean Time To Recovery (MTTR) outside of our 15-min target

The other item we are solving is meeting our 15 minutes target for region failover. This is caused by dependencies on an underlying managed service that doesn’t support automated failover within our target timeframe. Our teams are in the final stages of completing the switch, a managed service that allows us to automatically failover within 15-minutes, in Q1 2022.

We can successfully failover Availability Zones (AZ) today within our 1-minute target window as validated by quarterly testing.

## What Actions Have We Taken Already?

### Slowing down and invoking our change freeze earlier

Effective Sept. 30, 2021, we’ve significantly reduced the number and frequency of changes that we’re introducing into production for the remainder of the year. This is to introduce increased testing and soak time in pre-production environments. Heading into the holiday season, our protocols may change slightly, however, we anticipate continuing a conservative posture to maintain the stability of our production environments. We are mostly allowing changes that are related to our resiliency initiatives or security patches. Being an authentication platform, security-related changes are non-negotiable, as is our mission to protect you and your customers.

### New staging environment

As of early October, we have a staging environment that has the same load as US-1, so that we can simulate test cases reproducing production traffic at large scale. The volume and high load-related issues described above can now be more easily detected.

### Additional resources and re-prioritization of our roadmap

We have added team members and reprioritized resilience projects in order to complete these improvements in time for the holiday season. I am personally doing a daily stand-up with our Engineering leadership team to ensure there is an elevated review process and all blockers are actively being addressed. In addition, all new product and feature initiatives have been deferred until the new year.

### Resilience and holiday readiness efforts

After our outage on April 20th, a dedicated team of 40 engineers completed a 10-week task force to reduce the load on our environments that resulted in:

* Reduced cache load by removing unused feature flags and added in-memory caching of multiple per-environment feature flags.
* Removed 2 collections from our database that reduced total database writes by 10%.
* Reduced reads to the collection with the most reads within the database by 12%.
* Added limits to refresh tokens queries from the Management API.
* Added missing indexes for new collections in the database.

Some of the improvements identified were multi-quarter projects that are still underway and are expected to be completed this November. These projects will:

* Reduce the read/write workload by 10%.
* Reduce 40% of inserts/deletes from our database.
* Reduce 30% of inserts/deletes from our database in US-1 enviroment. This requires a deprecation of opaque access tokens and will take 6 months to complete.

In October, we started the following remediation projects to further reduce the probability of these failures:

* Refactoring our connections schema to remove high cardinality issues.
* Addressing noisy neighbor issues in our extensibility stack (also known as Webtask).
* Implementing an additional caching layer for reading requests.
* Proactively and significantly over-provisioning our stack in an effort to get ready for holiday traffic.
* Enforcing global active rate management per tenant at the edge.

The projects listed above are also scheduled to be live and in production by November 10. We know that all of the initiatives above will reduce the load on our environments and should significantly reduce the noisy neighbor issue I referenced above.

We are also initiating code change freeze windows over the holidays:

🟧 **Orange Change Freeze** 10/12 - 11/11 

🟥 **Red Change Freeze** 11/12 - 11/29 

🟧 **Orange Change Freeze** 11/30 - 12/16 

🟥 **Red Change Freeze** 12/17 - 01/03 

🟧 **Orange Change Freeze:** During this window, all production deployments are halted, and only work related to stability for Mission Critical Services, security patches or urgent releases on other components may be deployed. Changes must meet testing and approval criteria. 

🟥 **Red Change Freeze**: During this window, all production deployments are halted. Exceptions allowed only to resolve critical customer issues or security patches. Changes must meet testing and approval criteria. 

## Looking Beyond the Next 60 Days

### New environments and migration capabilities

We are now actively working on creating new environments in our US and EU regions. Our target is to progressively introduce 4 new environments in the US and up to 3 new environments in the EU in CY Q1 2022. The new environments allow us to dynamically allocate load as part of our demand response strategies and significantly reduce the blast radius of disruptions and outages. Our team is also actively scoping and designing an automated tenant migration process. We expect to have an automated tenant migration tool that will enable us to work with you and migrate you over to one of our newer environments beginning late CY Q1 2022.

### New platform rollout across clouds and regions

We began working on a modern platform last year that is poised to roll out across the regions and clouds that we operate in. This month we began the gradual rollout of this new platform and made it available on Microsoft's Azure cloud. This new platform architecture has been purposefully designed from the ground up to deliver a scalable, reliable, and resilient service that meets the current and future needs of our customers. We are targeting to make this available on AWS starting CY 1H 2022.

Finally, we truly appreciate your trust in Auth0 and will do everything that we can to keep that trust. I will post another public update in early CY Q1 2022 to share the results of all of our work in future blog updates including the progress of the improvement initiatives listed above.

_Please note: any unreleased products, features, or functionality referenced in this disclosure may not be currently available and may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._

Improving Our Platform Resiliency and Upcoming Holiday Plans

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Global identity management provider supports the launch of Ivy League MBA interactive learning platform

**BELLEVUE, Wash. – Oct. 28, 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced it has been selected as the identity and authentication provider for [Wharton Interactive](https://interactive.wharton.upenn.edu/), an interactive learning platform that draws on games, simulations, and research to make Ivy League business education more accessible to all. To enable a seamless, end-to-end experience for learners and educators, Auth0’s platform will provide a [Single Sign-on](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) (SSO) solution for learners and educators throughout their journey.

Wharton Interactive — founded by Sarah Toms, executive director, and Professor Ethan Mollick at the Wharton School, The University of Pennsylvania — has developed different modes of delivering education on its Alternate Reality Courseware (ARC) platform. ARCs knit together leading subject matter expertise and an immersive games-based experience where users gain mastery through practice and receive personal feedback about their performance every step of the way. By increasing inclusive access to business education, this unique higher ed initiative strives to better the socio-economic status of individuals and lift economies through job creation.

To aid in Wharton Interactive’s marketplace launch, the team wanted to create one, seamless user experience across the entire platform, from the user’s account creation and management to the interactive simulations and classes, and selected Auth0 to help. By implementing SSO, students and educators can enter their login credentials once and automatically gain access to multiple applications. Through the implementation of Auth0’s SSO solution, Wharton Interactive’s platform benefits from increased security and privacy while improving the end-to-end experience for users.

“Auth0 plays an integral role in making Wharton Interactive’s mission to transform education a reality by eliminating the hurdles associated with having to login to multiple systems along the customer journey,” said Sarah Toms, co-founder and Executive Director for Wharton Interactive. “We were searching for a top-notch identity provider with proven expertise in SSO, and are so pleased that we have partnered with Auth0. From vendor selection to launch, it took only a few months to build and deliver a comprehensive solution that was ready for market.”

“Wharton Interactive is democratizing higher education and transforming the eLearning space with its cutting-edge approaches, and identity is a key enabler in supporting this mission — strong user experience, security, and privacy practices all start at login,” said Ghazi Masood, General Manager and SVP of Americas at Auth0. “We’re honored to support Wharton Interactive’s identity needs and help them seamlessly scale as they make education more attainable and secure for educators and learners around the world.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Matter Communications for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com) 

### Investor Contact:
Investor Relations 
[investor@okta.com](mailto:investor@okta.com)

Wharton Interactive Selects Auth0 to Help Securely Democratize and Transform Education

An overall view of .NET, Microsoft's cross-platform development environment that allows you to build any type of application with C# and other languages.

Microsoft's ambition to provide developers with one platform to solve any type of problem has been fulfilled by .NET. For a couple of decades already, the .NET platform has been powering up web, desktop, and mobile applications in both the startup and enterprise scenes.

Without any doubt, .NET plays a central role in the software development industry. .NET popularity in the developer community is a fact. You can measure it through the number of open source projects around the world and the presence of [C# among the five most popular programming languages](https://www.tiobe.com/tiobe-index/). Its popularity is going to grow even more, especially after [the latest release (.NET 5)](https://auth0.com/blog/dotnet-5-whats-new/), which revolutionizes the industry by pioneering the concept of universal software development.

To understand the power of .NET, let's explore some of its technical foundations.

## What is .NET?

.NET is an open-source and cross-platform development platform for building many types of applications. Designed by Microsoft, the platform supports multiple programming languages and libraries to build web, mobile, desktop, IoT applications, and more.

![.NET 5 platform](https://images.ctfassets.net/23aumh6u8s0i/2bsVrNvzMOk64yfFw0ZU3O/b88d3412d42844d54011f31d69d5860f/dotnet5_platform)

<a href="https://devblogs.microsoft.com/dotnet/introducing-net-5/">[Source: Microsoft]</a>

Even if C# is considered the main programming language for .NET, you can use many other different languages of your choice. The languages directly supported by Microsoft are:

- [C# (C sharp)](https://docs.microsoft.com/en-us/dotnet/csharp/): A modern object-oriented programming language that belongs to the C language family. Its syntax may look familiar to C, C++, Java, and JavaScript developers.

- [F# (F sharp)](https://dotnet.microsoft.com/languages/fsharp): A functional-oriented programming language, member of the [ML](https://en.wikipedia.org/wiki/ML_(programming_language%29) language family. It also supports the object-oriented programming paradigm.

- [Visual Basic](https://docs.microsoft.com/en-us/dotnet/visual-basic/): The historical Microsoft programming language. It has become a full object-oriented programming language within the context of .NET.

.NET supports the [*Common Language Infrastructure*](https://en.wikipedia.org/wiki/Common_Language_Infrastructure) (CLI), so your source code is compiled into a [*Common Intermediate Language*](https://en.wikipedia.org/wiki/Common_Intermediate_Language) (CIL), independently of the programming language you use. This guarantees great interoperability between languages in the platform.

Besides the above mentioned languages supported directly by Microsoft, many other programming languages can compile to the .NET CIL. For example, ClojureCLR, Eiffel, IronPython, PowerBuilder, and many others. For a complete list, check out [this page](https://en.wikipedia.org/wiki/List_of_CLI_languages).

## .NET Architecture and Components

.NET allows you to build different application types, ranging from command-line to desktop applications, from web to mobile applications, from gaming to IoT applications.

This is possible thanks to its modular and optimized architecture.

### .NET Components

The .NET architecture is based on two main components:

- *CoreCLR*: This is the .NET runtime. It is responsible for executing CLI programs and includes a just-in-time compiler.

- *CoreFX*: The platform’s API implementing the CLI Standard Libraries, that is, the set of libraries that provide the most common functionalities, such as file system management, exception handling, network communication, threading, reflection, and so on. The CoreFX component is sometimes called the *Unified Base Class Library*.

### .NET Application Models

Above the core components, you have the different **application model frameworks**, that is, the libraries that offer support for developing different types of applications. So, for example, you have:

- [ASP.NET](https://dotnet.microsoft.com/apps/aspnet): The framework that allows you to build [web applications](https://auth0.com/docs/quickstart/webapp/aspnet-core-3) and [web APIs](https://auth0.com/blog/how-to-build-and-secure-web-apis-with-aspnet-core-3/).

- [Windows Presentation Foundation (WPF)](https://docs.microsoft.com/en-us/dotnet/desktop/wpf/?view=netdesktop-5.0): A graphical user interface for [Windows desktop applications](https://auth0.com/docs/quickstart/native/wpf-winforms).

- [Xamarin](https://auth0.com/blog/easy-authentication-xamarin-auth0/): The framework for building cross-platform mobile, TV, and desktop applications.

- [Blazor](https://auth0.com/blog/what-is-blazor-tutorial-on-building-webapp-with-authentication/): The framework to build client web applications by using C#. It also allows you to generate [client web apps in WebAssembly code](https://auth0.com/blog/securing-blazor-webassembly-apps/).

- [ML.NET](https://dotnet.microsoft.com/apps/machinelearning-ai): The machine learning framework that simplifies the integration of machine learning models in your .NET application.

In addition to application model frameworks, .NET offers you support for most of the common programming tasks: from file management to network communication, from security to database access. For example, on the networking side, it supports socket programming, HTTP communication, and [gRPC](https://auth0.com/blog/securing-grpc-microservices-dotnet-core/). This allows you to [create microservices](https://auth0.com/blog/implementing-microservices-grpc-dotnet-core-3/) with the protocol that better fits your needs.

For any other needs not embedded in the framework, you can find a huge number of specific libraries on the public [NuGet repository](https://www.nuget.org/). In fact, [NuGet](https://docs.microsoft.com/en-us/nuget/) is the package manager for .NET. It allows you to create, share, and use many .NET libraries for almost any purpose.

## .NET Design and Development Support

.NET support for software development is not limited to the multiple programming languages you can use. .NET also promotes the use of some best practices while letting you use the approach you prefer to build your application.

For example, it encourages you to [use dependency injection to decouple your application’s components](https://auth0.com/blog/dependency-injection-in-dotnet-core/). Dependency injection helps you design better software by limiting the component interdependence and facilitating reuse. In addition, it makes it easier to test your components.

By the way, on the testing side, .NET also comes with support for [unit and integration tests via xUnit](https://auth0.com/blog/xunit-to-test-csharp-code/).

On the front of the development experience, developers can choose from different approaches. They can use the [.NET CLI ](https://docs.microsoft.com/en-us/dotnet/core/tools/)environment, using the command line to create new projects, adding dependencies, build, run, and so on.

They can use [Visual Studio Code](https://code.visualstudio.com/) for an intermediate approach: an advanced cross-platform editor on top of the .NET CLI. Or they can use a powerful IDE like [Visual Studio](https://visualstudio.microsoft.com/vs/), available for both Windows and Mac, that provides you an interactive programming experience.

Regardless of the tool you choose, you can use many project templates to quickly start creating your new application. You can also [create your own .NET project template](https://auth0.com/blog/create-dotnet-project-template/).

## From the .NET Framework to the .NET Platform

Microsoft launched the .NET project in 2002. Since the beginning, the .NET goal was to create a universal platform for programming with any language. Of course, as the first step, Windows was the main .NET target.

However, Microsoft submitted the specifications of the .NET runtime infrastructure and the C# programming language to [ECMA](https://www.ecma-international.org/) for standardization. This led to the birth of a few porting projects on other platforms: Linux, embedded systems, mobile devices, browsers, and so on.

This also led to a fragmentation of the platform and sometimes generated confusion among developers. Take a look at [this article to learn more about the evolution of .NET](https://auth0.com/blog/navigating-dotnet-maze/).

Let’s try to clarify the differences among a few common concepts.

### .NET Framework

The .NET Framework was the initial flavor of .NET. It provides the developer with a set of APIs for the most common programming needs and interacts with the underlying operating system. It runs only on Windows, and its lifecycle is coming to an the end right now, after [the release of .NET 5](https://auth0.com/blog/dotnet-5-whats-new/).

### Mono

The Mono project brings .NET to Linux machines. It is the best known porting project based on the .NET standard specifications. Even if Mono's aim is to run on Linux applications built for the .NET Framework and vice versa, the compatibility is not always guaranteed. There are a couple of reasons for this: some .NET Framework features are too tied to the Windows operating system, and often the Mono implementation lags behind the newest .NET Framework features.

### .NET Core

.NET Core is a complete rewriting of the .NET Framework with the cross-platform goal in mind. Its redesigned architecture defines a minimal feature set as the common core across Windows, Linux, and Mac platforms. The rest of the features can be downloaded as library packages.

### .NET Standard

The .NET Standard is not another .NET implementation. It is a formal specification of .NET APIs that helps to create cross-platform libraries. If a platform supports a given .NET Standard version, then a library supporting the same version will run on it, regardless of the device type and the framework implementation (.NET Framework, Mono, .NET Core).

### .NET

Since the beginning, the .NET term has been used to indicate the universal development platform. However, many implementations arose since then, so the .NET name created ambiguities. .NET 5 aims to make concrete the initial vision of a universal development platform. It replaces the current existing implementations: .NET Framework, .NET Core, and even Mono. So, from .NET 5 on, only .NET will exist as a name and as a platform.

## Auth0 and .NET

Auth0 has extensive support for .NET that allows you to easily integrate modern authentication and authorization into your .NET applications: from specific SDKs to documentation, from blog posts to sample projects. In this section, you find a list of the .NET resources that Auth0 provides you.

### .NET QuickStarts

Auth0 Quickstarts help you in setting up your first [authentication](https://auth0.com/docs/authentication) and [authorization](https://auth0.com/docs/authorization) integration. They guide you in adding the needed code and the required configuration step by step. If you are logged in, the code snippets are configured for your account. If you don't have an account, you <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">can sign up for free with Auth0</a>.

The following .NET-related Quickstarts are available:

- [**ASP.NET Core Web API v3.1**](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi): This Quickstart helps you to add authorization to an ASP.NET Core Web API using the standard [JWT](https://jwt.io/) middleware.
- [**ASP.NET Core v3.1 Web Application**](https://auth0.com/docs/quickstart/webapp/aspnet-core-3): This Quickstart demonstrates how to add user login to an ASP.NET Core Web Application.
- [**WPF/Windows Forms (WinForms**)](https://auth0.com/docs/quickstart/native/wpf-winforms): The Quickstart guides you in adding user login Windows desktop C# applications.
- [**Xamarin**](https://auth0.com/docs/quickstart/native/xamarin): This Quickstart helps you add user login to Xamarin applications.
- [**Windows Universal App**](https://auth0.com/docs/quickstart/native/windows-uwp-csharp): Reading this Quickstart, you will learn how to add user login to [Windows Universal](https://docs.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide) C# applications.

### Software Development Kits (SDKs)

Auth0 provides you the following SDKs to help you to integrate authentication and authorization in your .NET applications:

- [**.NET Client Library for Auth0**](https://github.com/auth0/auth0.net): This SDK supports two APIs:
 - *The Authentication API*: This API allows you to add [OIDC](https://auth0.com/docs/protocols/openid-connect-protocol)-based authentication to your application
 - *The Management API*: This API allows you to interact with the [Auth0 Management API](https://auth0.com/docs/api/management/v2) and deal with your [Auth0 tenant](https://auth0.com/docs/videos/get-started-series/architect-your-tenant).
- [**Auth0 OIDC Client for .NET** ](https://github.com/auth0/auth0-oidc-client-net): This library supports [OIDC authentication](https://auth0.com/docs/protocols/openid-connect-protocol) for .NET desktop applications based on WinForms, WPF, and UWP as well as Xamarin mobile applications.

### .NET blog posts

In addition to SDKs and Quickstarts, Auth0 provides you with specific content, use cases, and code examples through its [developer blog](https://auth0.com/blog/developers/). You can find [many .NET-related articles](https://auth0.com/blog/search/?query=.net) that help you build and secure your applications and keep up to date with the most recent features. Most articles include a sample project to demonstrate how to practically implement your apps. You can download them from GitHub, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up with Auth0</a> if needed, configure the app, run it, and explore the code.

So, enjoy building your next .NET project with Auth0!

What is .NET? An Overview of the Platform

A guide for understanding the differences between .NET, .NET Core, .NET Framework, .NET Standard, etc. by exploring the history of the platform.

If you are confused in front of the different facets of .NET, or if you are not clear on the differences between .NET, .NET Core, .NET Framework, .NET Standard, and similar, well, this article is for you.

## What .NET Means Today

Say you are a new developer that wants to approach .NET. Caught up in the excitement, you navigate to [Microsoft's website](https://dotnet.microsoft.com/) and find the following definition:

![.NET: Free. Cross-platform. Open source. A developer platform for building all your apps (web, mobile, desktop, game, IoT).](https://images.ctfassets.net/23aumh6u8s0i/2yLTpLYPjn9DUjXgqHkN0f/03d54d78d435bc55ea6885a912cc9945/dotnet-platform.gif)

Cool! This platform looks great! You can build any kind of application by using C# or [any other .NET compatible programming language](https://en.wikipedia.org/wiki/List_of_CLI_languages).

However, there are issues are around the corner...

Maybe you find an awesome library on [NuGet](https://www.nuget.org/), but learn that it is for the .NET Framework and cannot use it in your project unless you target your project to .NET Standard 2.0. In that case, your application will also run on .NET Core.

What? Isn't .NET Framework just .NET? And what are .NET Standard and .NET Core?

Welcome to the .NET maze! If you don't want to get lost in it, you need [Ariadne's thread](https://en.wikipedia.org/wiki/Ariadne).

I understand that not everyone likes history, especially in the IT field. Many people prefer to know what and how to do things *today*. But, as it happens in everyday life, the past has a great influence on the present and also on the future. To understand today's and future .NET, you need to take a step back and trace its history, at least in broad strokes.

## In the Beginning Was the .NET Framework

In 2002, Microsoft promised one framework to build applications with any programming language: C# (born for that occasion), Visual Basic, and [many other languages](https://en.wikipedia.org/wiki/List_of_CLI_languages). The framework granted a common API set, language independence, interoperability with the underlying operating system and other non-.NET applications, portability (at least in perspective, at the time), and many interesting features.

Although the long-term idea was to make .NET a cross-platform framework, **the .NET Framework only ran on Windows**.

Don't get me wrong. Even if I'm speaking in the past tense, the .NET Framework is still alive and operative. Its [current version is 4.8](https://devblogs.microsoft.com/dotnet/announcing-the-net-framework-4-8/), and it is the last version of the framework, as you will learn later. But a huge amount of code runs on it, so you cannot consider it a dead framework yet.

## Mono on the Stage

One interesting thing is that Microsoft published the specifications of the [*Common Language Infrastructure* (CLI)](https://en.wikipedia.org/wiki/Common_Language_Infrastructure), that is, the .NET Framework runtime, and the C# language. Even better, they set them as open standards: [ECMA-335](https://www.ecma-international.org/publications-and-standards/standards/ecma-335/) and [ECMA-334](https://www.ecma-international.org/publications-and-standards/standards/ecma-334/). So pretty much anyone could implement the .NET runtime and the C# programming language.

In 2007, this paved the way for a project to port .NET to Linux: [the Mono Project](https://www.mono-project.com/). Other attempts to port .NET on Linux were made: [DotGNU](https://www.gnu.org/software/dotgnu/pnet.html) and [CrossNet](https://archive.codeplex.com/?p=crossnet), among others. However, only the Mono Project attracted significant interest and generated a production-ready framework.

However, not everything in the .NET Framework could be ported to Mono due to some strict dependencies on Windows. In addition, the state of Mono development was usually not so aligned with the current state of the .NET Framework. This actually created some friction with the real portability of .NET applications to Linux.

## .NET Everywhere

The open specifications of the .NET fundamental components were the first step towards the quick spread of the framework. Microsoft on one side and other independent developers on the other side brought the .NET Framework to different platforms.

When the .NET Framework was born, Microsoft also released the [.NET Compact Framework](https://en.wikipedia.org/wiki/.NET_Compact_Framework). It was a reduced version of the framework designed to run on devices with limited computing capacity, such as PDAs, mobile phones, set-top boxes, etc.
In 2007, the [.NET Micro Framework](https://netmf.github.io/) was launched: a more efficient version of the .NET Compact Framework that could also run directly on the hardware.

The same year, [Silverlight](https://en.wikipedia.org/wiki/Microsoft_Silverlight) brought .NET to the browser, providing developers with a framework for building rich Internet applications similar to Adobe Flash.

In 2009, the [MonoTouch](https://en.wikipedia.org/wiki/Mono_(software%29#MonoTouch) project started. It was the first attempt to port the Mono framework (that is, the Linux implementation of the .NET Framework) to iOS and Android. In a few years, the MonoTouch project became the foundation for [Xamarin](https://dotnet.microsoft.com/apps/xamarin), the framework for building Android and iOS apps with C# (2013).

So, as early as 2013, .NET allowed you to build applications for Windows and Linux machines, for embedded devices, for the browser, and for iOS and Android devices.

You may think that it was amazing! However, the proliferation of different environments led to a fragmentation of the framework itself. That wasn't much of a problem for those who were developing applications. Applications are usually platform-specific. This fragmentation was a big problem for library developers. In fact, a .NET assembly could theoretically be loaded in any .NET runtime. Unfortunately, it could break at any point if it calls an API that wasn’t supported by the platform it is running on.

The cross-platform dream had not yet come true.

<include src="TweetQuote" quoteText="As early as 2013, .NET allowed you to build applications for Windows and Linux machines, for embedded devices, for the browser, and for iOS and Android devices."/>

## The Rise of .NET Core

In 2014, to pursue the goal of an actual cross-platform development framework, Microsoft started writing .[NET Core](https://github.com/dotnet/core) from scratch. The first release was ready in 2016. The new framework was a complete redesign of the .NET specifications with cross-platform support in mind. In fact, its runtime ran on Windows, Linux, and macOS.

This new framework didn't have the backward-compatibility constraints that the .NET Framework had. Its modular architecture provided smaller versions of the framework's core components, letting the developer download the additional components from the NuGet repository. This refactoring enabled simplified deployment and portability.

## The Need for a Standard

While .NET Core was a step in the right direction for cross-platform support, it brought yet another implementation in the already entangled .NET ecosystem. In other words, a library developer has another potential pain point for the portability of their library.

Microsoft tried to put order into this chaos by [introducing the .NET Standard](https://devblogs.microsoft.com/dotnet/introducing-net-standard/). This is not just another framework implementation, but a formal specification of .NET APIs that multiple .NET platforms have to implement. Different .NET Standard versions define different .NET API sets. This way, a .NET implementation declares which .NET Standard version it supports. The library developer needs to target that specific .NET Standard version.

For example, if you want your library to run on .NET Framework 4.5, .NET Core 2.1, and Mono 4.6, you should target your project to [.NET Standard 1.1](https://github.com/dotnet/standard/blob/master/docs/versions/netstandard1.1.md). See the [official documentation to take a closer look at the .NET Standard](https://docs.microsoft.com/en-us/dotnet/standard/net-standard).

Targeting a .NET Standard is a matter of specify the [Target Framework Moniker (TFM)](https://docs.microsoft.com/en-us/dotnet/standard/frameworks) in the .NET project file. It is something like the following in your .NET project file:

``` xml 
<Project Sdk="Microsoft.NET.Sdk">

 <PropertyGroup>
 <TargetFrameworks>netstandard2.0</TargetFrameworks>
 </PropertyGroup>
 ...
</Project>
```

## Only .NET from Now On

Finally, in November 2020, [.NET 5 was released](https://auth0.com/blog/dotnet-5-whats-new/). This new version of the framework aims to be the unified .NET platform from now on. No more need for different implementations: .NET 5 is the common set of APIs that runs on Windows, Linux, Mac, iOS, and Android. So, if your project targets .NET 5, your code will run on all those platforms.

![.NET 5 platform](https://images.ctfassets.net/23aumh6u8s0i/62ADaRg2zm1S8J9gpKX6Kv/a062f9c576330a811fb155da37104beb/dotnet5_platform)
<a href="https://devblogs.microsoft.com/dotnet/introducing-net-5/">[Source: Microsoft]</a>

If you need a given platform's APIs, you should use a specific TFM. For example, if you want to use [Windows.Forms](https://docs.microsoft.com/en-us/dotnet/desktop/winforms/?view=netdesktop-5.0) for your desktop application, you need to specify the `net5.0-windows` TFM, since this feature is supported on the Windows operating system. Of course, in this case, you know that your code will run only on that specific platform.

.NET 5 removes the need for .NET Standard. Actually, you may think of .NET 5 as the evolution of .NET Standard. However, .NET 5 is not a formal specification but an actual implementation. Also, the release of .NET 5 marks the end of .NET Framework.

At this point, you might ask: .NET 5 is the subsequent version of .NET Core 3.1. What happened to .NET 4?

The answer is pretty simple: there is no .NET 4! Microsoft decided to skip this version to avoid confusion with .NET Framework 4.x. So, from now on, .NET will have no more Framework, Core, Compact, or Micro. The future of .NET will have no other qualifier than just its version.

<include src="asides/DotNetCore" />

.NET Core vs .NET Framework vs .NET Standard: A Guided Tour

What's new in .NET 5? Learn how .NET Core and .NET Framework evolve into the new cross-platform framework.

.NET 5, the successor of .NET Core 3.1 and .NET Framework 4.8, aims to provide .NET developers with a new cross-platform development experience. It puts order to the .NET universe fragmentation that has been arising over the years and brings new amazing features. Of course, you cannot learn all about .NET 5 right now, but you can focus on just five things to have a clear understanding of what is going on.

## The Unified Platform

The first thing you have to know is that .NET 5 brings you a new unified vision of the .NET world.

If you have been working with .NET, you may be aware of its platform fragmentation since its first release in 2002. The .NET Framework was initially designed for Windows, but its runtime specification, also known as Common Language Infrastructure (CLI), was standardized as [ECMA 335](https://www.ecma-international.org/publications/standards/Ecma-335.htm).

The standardization allowed anyone to create their own implementation of the .NET runtime. And in fact, a few of them appeared on the horizon: [Mono](https://www.mono-project.com/) for Linux-based systems, [Silverlight](https://www.microsoft.com/silverlight/) for browser-based applications, .[NET Compact](https://en.wikipedia.org/wiki/.NET_Compact_Framework) and [Micro](https://en.wikipedia.org/wiki/.NET_Micro_Framework) frameworks for mobile and resource-constrained devices, and so on. Then, Microsoft decided to write .NET Core from scratch with cross-platform compatibility in mind.

These different implementations raised the need to understand where a .NET package could run on. Should you build different versions of your library to distribute it? The answer to this question was [.NET Standard](https://docs.microsoft.com/en-us/dotnet/standard/net-standard), i.e., a formal specification of the common APIs you should expect across CLI implementations. In other words, if you build your library for one specific .NET Standard, you'll be guaranteed it will run on all the runtimes that implement that specification.

You understand that, in this messy situation, the desired cross-implementation compatibility is not so easy to achieve. This is why .NET 5 appears on the scene.

![.NET 5 Platform](https://images.ctfassets.net/23aumh6u8s0i/l9JJaTYKjT55fB2VDus2R/d3bbe04d363cf6e022e24ca882840173/dotnet5_platform)

[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-5/)]

The new .NET platform is the unified successor of the various .NET flavors: .NET Framework, .NET Standard, .NET Core, Mono, etc. It is officially the next version of .NET Core 3.1, but basically determines the end of .NET Framework, .NET Standard, and the other variants that caused big headaches to .NET developers.

.NET 5 provides a common set of APIs that aligns the different runtime implementations. This set of APIs is identified by the `net5.0` [Target Framework Moniker](https://docs.microsoft.com/en-us/dotnet/standard/frameworks) (TFM), which is the token you set in your .NET project to specify the target framework. This enables your application to run on any runtime implementation supporting .NET 5. However, you can still build applications for a specific platform. For example, to build an application that uses Windows API, you need to specify the `net5.0-windows` TFM. This way, building a platform-specific application is **your** choice, not a choice depending on the runtime implementation you are using to develop your application.

Of course, achieving this unified platform required a significant effort and an internal architecture rearrangement. A few features have been removed from the core API set, as you will see later on, but [the platform gained a general improvement in performance](https://devblogs.microsoft.com/dotnet/performance-improvements-in-net-5/).

While the new .NET 5 comes with the platform unification goal, the initial plan changed because of COVID-19. In fact, .NET 5 sets the foundations of the unification, but it will be completed with .NET 6 in November 2021. With that release, you will get the stable release of the new Universal UI and support for the specific TFMs for Android (`net6.0-android`) and iOS (`net6.0-ios`), for example.

<include src="TweetQuote" quoteText=".NET 5 was born with cross-platform compatibility in mind."/>

## New Features in C# #

The second thing you should know is about C#. .NET 5 comes with C# 9, the new version of the .NET platform's main programming language. There are several new features, but here you will find a taste of the most relevant ones.

### Top-level statements

Among the new features, one of the most notable is the introduction of **top-level statements**. To learn what they are, take a look at the following classic minimal program:

<include src="AmpWarning" fullUrl="https://auth0.com/blog/dotnet-5-whats-new"/>

``` csharp 
using System;

namespace HelloWorld
{
 class Program
 {
 static void Main(string[] args)
 {
 Console.WriteLine("Hello World!");
 }
 }
}
```

Just to write one string to the console, you need to define a namespace, a class, and the static method `Main()`. Now, you can get rid of this code infrastructure and simply write the following:

``` csharp 
System.Console.WriteLine("Hello World!");
```

Top-level statements allow you to focus on what really matters in small console programs and utilities and use C# with a more scripting-oriented approach.

### Record types

Another interesting new feature is **record types**. With records, you can declare an immutable reference type, i.e., a class-based type that cannot be changed after its creation. An example of a built-in immutable reference type is the `System.String` class. After you create an instance of a `System.String`, you cannot change its value anymore.

Consider the following record type declaration:

``` csharp 
public record Person
{
 public string FirstName { get; }
 public string LastName { get; }

 public Person(string first, string last) => (FirstName, LastName) = (first, last);
}
```

You can create an instance of the `Person` record as you do with a class, but you can't change its `FirstName` property:

``` csharp 
var person = new Person("John", "Doe");

person.FirstName = "Jack";	//throws an error
```

However, you can compare two instances of the `Person` record similarly to primitive values:

``` csharp 
var person = new Person("John", "Doe");
var anotherPerson = new Person("John", "Smith");

Console.WriteLine(person == anotherPerson); //false
```

### Init setters

C# 9 also adds the `init` accessor to define **properties that can only be initialized**. To better explain its use cases, consider the following class definition:

``` csharp 
public class Person {
 public string FirstName { get; init; }
 public string LastName { get; init; }
 public string Address { get; set; }
}
```

This class defines a person with `LastName` and `FirstName` properties that can be initialized, but not changed. The `Address` property can be changed at any time:

``` csharp 
var person = new Person {
 FirstName = "John",
 LastName = "Doe",
 Address = "124 Conch Street, Bikini Bottom, Pacific Ocean"
}

person.Address = "17 Cherry Tree Lane";
person.FirstName = "Jack";	//throws error
```

If you want to learn more about the features brought by C# 9, please [check out the official documentation](https://docs.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-9).

## .NET MAUI, the Universal UI

As the third thing, you have to know that .NET 5 is bringing to you a new way to build cross-platform user interfaces. Thanks to the **.NET Multi-platform App UI** framework, also known as **.NET MAUI**), you will be able to build user interfaces for Android, iOS, macOS, and Windows with a single project.

> Actually, this feature is still in progress and will be released with .NET 6, but [you can start taking a look at .NET MAUI](https://github.com/dotnet/maui) to be ready when it is officially released. Take a look at [the roadmap](https://github.com/dotnet/maui/wiki/Roadmap) to follow its progress.

.NET MAUI can be considered an evolution of [Xamarin.Forms](https://dotnet.microsoft.com/apps/xamarin/xamarin-forms), the open-source framework for building iOS and Android apps with a single .NET codebase. But this new framework proposes a universal model for building UIs on mobile and desktop platforms.

![.NET MAUI](https://images.ctfassets.net/23aumh6u8s0i/5QASNuBVJCrC7bIIH6RLct/0edcc3942920c3e8dc49b49026bfeff0/maui-overview)

[[*Source: Microsoft*](https://devblogs.microsoft.com/dotnet/introducing-net-multi-platform-app-ui/)]

In addition to the well-known [Model-View-ViewModel](https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93viewmodel) (MVVM) pattern, .NET MAUI supports the new *Model-View-Update* (MVU) pattern. This is a one-way data flow pattern inspired by the [Elm programming language architecture](https://elmprogramming.com/model-view-update-part-1.html) that provides an effective way to manage UI updates and application state.

## Supporting Single-File Applications

The fourth thing you will get in .NET 5 is the support of **single-file applications**, that is, applications published and deployed as a single file. That means that your application and all its dependencies are bundled into one file. For example, say you run the following command within the folder of your .NET 5 project:

``` bash 
dotnet publish -r linux-x64 --self-contained true /p:PublishSingleFile=true
```

You will get a single file containing your application built for Linux, all the dependencies you used in your project, and the .NET runtime (`--self-contained true`). This means that you even don't need to install the .NET runtime on the target machine.

Of course, you can also specify these parameters in your project configuration:

``` xml 
<Project Sdk="Microsoft.NET.Sdk">

 <PropertyGroup>
 <OutputType>Exe</OutputType>
 <TargetFramework>net5.0</TargetFramework>
 
 <PublishSingleFile>true</PublishSingleFile>
 
 <SelfContained>true</SelfContained>
 
 <RuntimeIdentifier>linux-x64</RuntimeIdentifier>
 </PropertyGroup>

</Project>
```

Be aware that this feature doesn't use the same approach as the single-file applications you can build in .NET Core 3.1. In .NET Core 3.1, the single-file application is just a way to package binaries. At run time, they are unpackaged to a temporary folder, loaded, and executed. In .NET 5, the single-file application has a new internal structure, and it is directly executed with no performance penalty.

Take a look at the documentation to [learn more about this deployment type](https://docs.microsoft.com/en-us/dotnet/core/deploying/single-file).

## No Longer Supported Technologies

The last of the five things you are learning about .NET 5 concerns what is no longer supported. As said above, the architectural review and the attempt to make .NET 5 an actual cross-platform programming framework led to removing a few features supported in .NET Framework. Let's take a quick look at the removed features and the possible alternatives.

### Web Forms

For a long time, [ASP.NET Web Forms](https://dotnet.microsoft.com/apps/aspnet/web-forms) has been the main technology to build dynamic web UIs. However, it is not a secret that its lifetime was closely bound to .NET Framework's destiny. .NET Core doesn't support Web Forms, so the fact it is no longer supported in .NET 5 shouldn't actually be news.

However, you have a few alternatives to build web UIs. If you are building traditional web applications, [Razor Pages](https://docs.microsoft.com/en-us/aspnet/core/tutorials/razor-pages/?view=aspnetcore-5.0) are one of these alternatives. If you want to build single-page applications, you can use [Blazor](https://docs.microsoft.com/en-us/aspnet/core/blazor/?view=aspnetcore-5.0).

### Windows Communication Foundation (WCF)

Even [WCF](https://docs.microsoft.com/en-us/dotnet/framework/wcf/whats-wcf), the traditional communication framework for Windows, is going to be deprecated. This may appear a bit shocking for the developers that have used it to build their service-oriented applications. However, it is pretty understandable if you realize that the primary goal of .NET 5 is becoming a cross-platform framework.

The alternative to WCF recommended by Microsoft is to migrate to [gRPC](https://docs.microsoft.com/en-us/aspnet/core/grpc/?view=aspnetcore-5.0). But if you are nostalgic about WCF or want to prepare a smooth transition, you can give the [CoreWCF](https://github.com/CoreWCF/CoreWCF) open-source project a try.

### Windows Workflow Foundation

Finally, .NET 5 will not even include [Windows Workflow Foundation](https://docs.microsoft.com/en-us/dotnet/framework/windows-workflow-foundation/), the workflow engine technology available in .NET Framework. There is no official replacement for this technology. However, you can use an open-source porting project, [CoreWF](https://github.com/UiPath/corewf), to attempt moving your existing workflows on .NET 5 or creating new ones.

## Summary

At the end of this article, you have a high-level idea of how .NET 5 will impact your existing .NET projects and which opportunities the new platform is going to offer you. Maybe these highlighted five things may seem like little stuff, but they should allow you to find your way around this turning point in the .NET evolution.

Of course, you can [try .NET 5 right now by downloading its runtime and SDK]( https://dotnet.microsoft.com/download/dotnet/5.0).

While .NET 5 is out, many applications that need security rely on older versions of .NET. Here’s how you can secure an [ASP.NET](http://asp.net/) Core 3.x with Auth0. The same patterns should apply to .NET 5. Let us know in the comments if you bump into any difficulties.

<include src="asides/DotNetCore" />

Five Things You Should Know About .NET 5

New private cloud deployment option offers customers greater choice, scalability, and reliability

**BELLEVUE, Wash. – Oct. 13, 2021 –** The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced the launch of the [Auth0 Identity Platform on Microsoft Azure](https://auth0.com/cloud/azure). The launch gives customers the ability to choose Azure as their cloud deployment option from Auth0. The addition of Azure as an Auth0 private cloud platform option unlocks a secure cloud deployment option for organizations seeking strategic fit with their technology stack, supporting regional data residency capabilities and higher control over customer data.

Today, organizations moving to the cloud and selecting a [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) solution require significant control over sensitive customer data and may require local data residency capabilities. They often have to make a hard choice of selecting either a CIAM solution that supports their product differentiation goals or one that meets their technical requirements and regulatory needs. Auth0’s modern identity platform eliminates the need to choose by providing organizations with tools designed to support security, compliance, and data residency needs that may apply to them across multiple regions globally. The platform’s design can accelerate their time to value and go-to-market strategies to meet their long-term growth goals. 

Key benefits of the Auth0 Identity Platform on Azure include:

* **Technology Stack Alignment:** Organizations have the flexibility to choose Azure as their preferred cloud vendor for greater technology stack alignment with existing investments in Azure. 
* **Data Residency:** Improved data residency capabilities for Auth0 customers with Azure’s widespread geographic infrastructure.
* **Streamlined Experience with Private Cloud:** A modern, cloud-native platform built with a focus on security and compliance at every level. Organizations requiring data residency options can take advantage of periodic feature updates while maintaining control over the timing and the ability to roll back without the hassle of having to maintain them — resulting in faster time to market and a more seamless experience for organizations and their customers.

“As more applications move to the cloud and expand globally, organizations depend on their identity service to protect and manage access for their most critical users, applications, and data,” said Shiv Ramji, Chief Product Officer at Auth0. “The Auth0 Identity Platform on Azure can help unlock a secure and compliant cloud deployment experience for organizations seeking support across CIAM use cases. This is especially true for organizations in industries like retail or financial services where selecting vendors that are not competitive to their business is top priority, organizations operating in regions where certain cloud providers have higher geographic availability, and those that have existing technology investments in Azure.”

“Companies like Auth0 add value by integrating their solutions with Microsoft Azure,” said Mandana Javaheri, Global Senior Director, SCI Business Development at Microsoft Corp. “With Azure, Auth0 customers have ultimate performance capabilities and control over their environment without the hassle of maintaining it, allowing customers to focus more on their core business proposition.”

More detailed information on the Auth0 Identity Platform on Azure can be found on [Auth0’s blog](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option). Auth0 will discuss this offering in greater detail with Okta at Showcase21 taking place today, Oct. 13, 2021. To learn more, visit: [https://www.okta.com/showcase/register](https://www.okta.com/showcase/register) 

<include src="asides/AboutAuth0" />
### Media Contacts:

Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter Communications for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com) 

### Investor Contact:
Investor Relations 
[investor@okta.com](mailto:investor@okta.com)

Auth0 Identity Platform Now Available on Microsoft Azure

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

The bcrypt hashing function allows us to build a password security platform that scales with computation power and always hashes every password with a salt.

Hashing in Action: Understanding bcrypt

Tech platform supporting more than 13,000 local pizzerias nationwide relies on scalability and login security with Auth0

**BELLEVUE, Wash. – October 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has been selected as the sole identity and authentication provider for [Slice](https://slicelife.com/), the innovative tech platform powering America’s local pizzerias. Having recently closed a successful [round of Series C funding](https://blog.slicelife.com/slice-raised-43m-in-series-c-funding-to-power-local-pizza/), Slice will use Auth0’s platform to provide a secure login experience for Slice’s five million customers as it continues to scale. 

Slice transforms independent pizzerias with the specialized technology, data insights, and shared services needed to serve today’s digital-minded consumers. Its vast network of more than 13,000 local pizzerias enables these small businesses to compete against major corporate chains and form the nation’s largest marketplace for authentic pizza across 3,000 cities in all 50 states. 

As its network of pizzerias and customers continues to grow, Slice looked to Auth0 to provide authentication for its growing consumer base, already over five million users. After a thorough review of solutions, Auth0 was determined to be a much better fit for scale, security, and lower ongoing maintenance costs. Another big factor in selecting Auth0 was its ability to support bulk migration, eliminating the hassle for end-users to have to reset their passwords.

“Auth0 is the only identity management platform that offers the level of flexibility, security, and customization we need,” said Jason Ordway, CTO for Slice. “Our goal is to provide our users across the country with easy access to their favorite local pizzerias. Auth0 will be a great partner in enabling that while also setting us up for success for our continued growth.”

“Slice is transforming the pizza business, and is helping local businesses move online to keep up with today’s digital demands, especially during the pandemic,” said Ghazi Masood, SVP of Americas for Auth0. “We are thrilled to support Slice’s identity needs and help them seamlessly scale to continue expanding their network.” 

<include src="asides/AboutAuth0" />

### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Delivers Secure Authentication for Slice

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Learn how to deploy JavaScript Single Page Applications on different platforms.

The Complete Guide To Deploying JavaScript Applications - Part 2: Single Page Applications, Logging, SSL

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

Building a world-class security program to protect the world’s identities

If you are using our platform then you’re already benefiting from an advanced Product Security program, cloud security specialists, and a dedicated Detection and Response team monitoring 24/7.

Auth0 is a platform that helps application builders innovate faster. This means reducing the complexity of building identity into your applications, helping you move as quickly and securely as possible. But, identity is not simple; implementing the security protocols themselves is complex and there is inherent messiness in web security. This is why Auth0 has put in place a world-class security program to also make that easy for our customers.

I wanted to share more about how we run our program and what’s going on behind the scenes to protect all our customers. It’s something I started to talk about last year in an [interview](https://www.heavybit.com/library/podcasts/the-secure-developer/ep-32-security-and-compliance-with-duncan-godfrey-of-auth0/) with [Guy Podjarny](https://twitter.com/guypod) on the Secure Developer podcast and it’s something I will be talking about more this year.

<include src="TweetQuote" quoteText="There is no blueprint for success when it comes to building a security team, but in this post, @Auth0’s Sr. Director of Security + Compliance Duncan Godfrey shares the steps we’ve taken at Auth0 to create a world-class security program to protect the world’s identities."/>

There is no blueprint for success when building a Security Team. You will find different corporate structures and different structures to the engineering and operational teams. The teams grow organically, as you iterate on the makeup of their skills and their responsibilities all tied to the risks specific to your business. Within the Security community, we collaborate and compare notes with your peers in the industry, and that’s what I see. Leaders have optimized in different areas depending on their risks.

## What Is the Mission of Our Security Team?

Why does the Security Team exist? Trust is foundational to our success, and it's the Security team’s mission to build and maintain trust with our customers — and our customers’ customers and partners. As an IDaaS platform, we recognize that our solution is a building block for trust. We should never be a threat vector for our customers. This complicates the execution of a Security Program but in a way that attracts talented engineers who want to be part of a company that is at the center of the identity ecosystem.

## With a Million Different Priorities, How Do You Know Where to Focus?

Security is no different from any other successful business unit, you ruthlessly prioritize your resources to push towards your goals. Governance, risk, and compliance have been a peer to Security Engineering and helps us drive our focus and requirements. Both teams report to the CISO meaning they are not auditing our controls after the fact, they are part of the conversation.

The underpinning of any good security program is risk management. During our first ISO 27001 audit, we solidified this as a process and it’s something I have enjoyed reworking and improving. Whatever methodology you choose (e.g. [NIST](https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final), [FAIR](https://www.fairinstitute.org/)) having a realistic order of risk linked backed to all your information assets helps you prioritize and communicate with the rest of the business. And, using this we can prioritize investment in our controls.

Auth0 sells a security product, engineers here are building security at a security company. Something that has been different at Auth0 is that our most critical assets are actually our business process, our logic, our API the mechanisms that we provide to our customers more so than directly our data (not that isn’t also a critical asset).

We’ve always done things a little differently which adds some more interesting variables to our Enterprise, Auth0 is cloud-native in both our production infrastructure and our office apps; we are remote and we have and are growing very quickly.

<include src="TweetQuote" quoteText="Security is no different from any other successful business unit, you ruthlessly prioritize your resources to push towards your goals,” says @Auth0’s Sr. Director of Security + Compliance Duncan Godfrey. In this post, he shares how he makes his choices."/>

As well as our individual company risks our customers themselves have demanding high-security requirements. This all drives our investment in security, the development of our teams, and the rigorous [compliance](https://auth0.com/security/) regime we put ourselves through.

There are different models for defining the varied focus of Security Engineering teams. I have always liked ["Builders, breakers, and defenders"](http://michael-coates.blogspot.com/2011/02/vision-for-owasp.html). There has also been some standardization on using colors to communicate focus or capability (with the strongest associations being with defensive (blue) and offensive (red)). What you will see as I discuss the different teams we have tended to focus on defense but that is already starting to change.

The structure we have currently for the security engineering teams are:

* Product Security
* Cloud Security
* Detection and Response
* Security Awareness


## Product Security Team

Our Product Security team is a cross-functional Application and Product security team containing engineers who like building and breaking software. Product Security can mean different things to different security professionals for us it is supporting the product development lifecycle. 

Primarily the charter of these team has been:

* Developing a mature frictionless secure development lifecycle (SDL or SDLC). 
* Building tools to automate security in our CI/CD pipeline and developing libraries to wrap core security functions safely for developers and the building side (owning and developing libraries for specific security-focused operations of the product).
* Vulnerability Management
* Security Awareness and Training

It’s multidisciplinary as these functions can require different but overlapping skill sets. Supporting an SDL requires people who can run threat modeling exercises and work with developers to architect good security controls in response to the risk. Building tools and libraries require a Software Development Engineer (SDE) who can release and manage production code. We build a specialist product whose mission is to simplify that complexity for our customers. So within this team are experts in Identity protocols and how to abuse them.

Successfully handling vulnerabilities is a core capability for a security team, to protect the company from the impact of their exploitation. Making sure that once something is identified clearly communicated to the engineering teams and tracked to remediation. Day-to-day this means working with internal engineering teams and external researchers and third party penetration companies.

One of the things you may notice is that we have invested a lot in our supportive functions (e.g. SDL and VM). One of the changes that are already upon us is that we are now growing our breaking side, the team is becoming more involved in specific offensive security testing and red teaming.

## Cloud Security Team

Auth0 is cloud-native and we have built our product predominately on Amazon Web Services. AWS is a complicated product with a wide surface area, it offers developers a lot of freedom to build but it also offers a lot of opportunities to create an unnecessary attack surface. You need specialists in your Security team who understand building secure infrastructure in the Cloud and who can keep up with the high rate of change. This is where the Cloud Security team comes in, they secure our cloud infrastructure. 

This team grew out of a need to harden and secure access to an ever-growing number of AWS accounts. And, along with this, the founding charter was to ensure that we’re collecting data from every possible nook and cranny of AWS, pulling it in for analysis. Security monitoring has always been a foundation security building block for me and I have put a lot of emphasis on monitoring, security monitoring, gathering logs, and making sure we have a good audit trail for everything that we do. 

One of the advantages but also potential pitfalls of the cloud is how your workloads are now spread widely and dynamically. Making sure you are tracking assets is now similar to a big data problem and this team provides services to monitor these without slowing anyone down. Creating graphs from our non-standard networks and providing enriched data for analysis.

When people typically think of security engineers, they think of people who run firewalls or they do the configuration on routers and things like that. But really, that’s not how you can operate in a Cloud environment anymore, and that’s not how you can operate. In theory, everyone’s writing software, so it’s security software engineers building security services with some more infrastructure ops people now mixed into the team to help them scale those services too.

As the team has grown they have also been able to build tools for developers to be able to access and deploy safely to the Cloud too. Building tooling to provide ephemeral access was a huge win here, with scoped short-lived access credentials becoming the norm in our environment.

## Detection and Response

The Detection and Response (DR) team’s charter is a threat detection and incident response (IR). This team is our insurance policy, they are the cool heads in a crisis. They’re trained incident responders who can deal with tough issues, collaboratively troubleshoot and problem solve. It’s also at the core of what the Security team does for the business which has come more into focus during our [pandemic planning](https://auth0.com/blog/how-to-create-an-actionable-pandemic-plan/).

As a company grows an IR team is something you can afford to invest in. it’s not that you won’t have to deal with incidents before you have a dedicated team, but until you reach that point it’s likely a shared responsibility within the security team. This means that getting to the point of having specialists is also a major release of pressure for the security org - especially for folks who are not naturally drawn to the adrenaline rush of IR.

We have taken a hybrid approach while building our [Security Operation Center](https://en.wikipedia.org/wiki/Security_operations_center)(SOC). We use an MSSP to enable us to guarantee 24/7 eyes on glass coverage and first-line triage. With our partner, supporting us with some of the easier operation work enabled us to take a modern approach to build a DR team. This means hiring Engineers who have both the technical skills to build detections and automation, while also having the people skills to run an incident. Which, is a skill set that is very in demand in the security market.

## Security Culture

Everyday human mistakes are still the most [common path to compromise](https://enterprise.verizon.com/resources/reports/dbir/2019/summary-of-findings/). This why an effective Security Culture program is such a critical component of a successful security program. We invested in this early on and have a dedicated resource crafting training to fit our companies culture.

It’s something that is often unestimated and underinvested in; with the classic tick box mandated annual Security Awareness Training is an example of something that is often very generic but is actually a great opportunity to grab the attention of everyone at your company, in one go. If you affect even only a percentage of those people it’s a huge security win. The feedback we got last year justified the investment and hopefully won us some fans. Beyond this, we have expanded to improve onboarding training, building-specific developer-focused secure code training, and anti-phishing training.

## Modern Cybersecurity is a Complex Operation

Good security is a process and it’s something that you build towards. You mature your operations and process driving towards continually raising your bar and reducing risk. When you are using our Product you now have the Auth0 Security team protecting your identity 24/7.

<include src="asides/AboutAuth0" />

Securing a Platform

ana-cidre

Ana Cidre is a passionate advocate for the developer community and leads the Developer Advocacy team at Auth0. She's committed to fostering a more inclusive and diverse tech world, drawing on her technical background and strategic vision to improve developer experiences and build meaningful connections.

 

As the founder of GalsTech, an initiative supporting women in tech in Galicia, and through her active efforts to create welcoming spaces for underrepresented groups, Ana's dedication to diversity and inclusion extends beyond her daily work.

 

Ana has a proven track record of building global Developer Relations teams, cultivating active developer communities, and crafting impactful educational content. She maintains a strong connection to the community through speaking engagements and direct interaction with developers.

Sr Manager, Developer Advocacy

Ana Cidre

Sam4-square

I'm an Identity nerd with many years of experience as a developer and advocate. I love explaining complex topics clearly and understandably. You can find me on stage at developer events worldwide or simply having great conversations in the hallway. Google has recognized me as a Google Developer Expert (GDE) in the domains of Web Technologies, Security, Privacy, Payments, and Identity.

Sam Bellen

Avocado Labs is a platform where we share expert content about web technologies.

On April 17th, 2020 we launched a new initiative run by the Developer Relations team at Auth0: [Avocado Labs](https://avocadolabs.dev). With this initiative, we are on a mission to bring expert content to you, in the comfort of your own home.

## What is Avocado Labs?

Avocado Labs is a platform where we share expert content about web technologies. Our first approach is through online meetups. We will be hosting bi-weekly meetups which consist of two talks per meetup and each edition will be focussed on one technology. Our first episode was about Angular and more specifically Ivy, the Angular compiler. We had two incredible speakers who are renowned specialists in their fields and Google Developer Experts for Angular: Manfred Steyer and Martina Kraus.

In the future, we want to explore other ways of delivering content and figure out what the community is hungry for! We also want to bring communities closer together and find ways of doing it virtually! If you have any suggestions, please feel free to reach out to us on [Twitter](https://twitter.com/Avocado_Labs).

## Why Avocado Labs?

This question is probably the most important. At Auth0, one of our core values is that “We give a sh^\* t” and we really do! The technological community is important to us and we know that it isn’t always easy to go to a conference or a meetup, no matter what the reason might be. We believe that anyone and everyone should be able to have access to quality content and to be able to be part of a community.

We also know that right now the majority of the world is on lockdown which means that people cannot go to physical events, speakers cannot deliver amazing content, and communities cannot gather. We want to help in these times by providing at least some of this. But like mentioned above, this is an ongoing initiative. We won’t stop once things go back to “normal” - Whatever that new normal might be.

![Avocado Labs](https://images.ctfassets.net/23aumh6u8s0i/7vPhXR3e4hzNxn7XdxN8x1/d97fb8dd11cd30179423535a03240a38/avocado_twitter)

## So, What Now?

Why not join us? To follow up on what we’re up to, you can follow us on [Twitter](https://twitter.com/Avocado_Labs). If you’re interested in attending our online events, we suggest that you join our [meetup group](https://www.meetup.com/avocado-labs-talks/). And if you would like to speak at one of our events, please fill out our [call for papers](https://forms.gle/k6gLQc94xTjSunHXA).
Also, any suggestions are more than welcome! Just send us a direct message on Twitter.

## And… What’s Next?

Avocado Labs just took off 1 week ago, so we’re still at a very early stage, but we have plans to grow! One of the first things we want to do is to have our own website where we share all the content and events we are hosting and have already hosted.

Like mentioned before, we want to start exploring other ways of delivering content. That might happen as a podcast, live streams, or maybe even something completely different! This initiative is for the community, so we are all ears and we want to know what you want.

Another part of Avocado Labs that we want to work on is bringing the community together. One of the most valuable parts of in-person events is meeting friends and making new ones. We want to find ways to mimic those virtually, whether it’s through a Zoom call, demos, or maybe even online escape rooms!

We are very excited to see where this adventure takes us and we would very much like to see you come on this journey with us :)

<include src="asides/AboutAuth0" />

Introducing: Avocado Labs

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

The value in healthcare M&As lies in data. The right IAM platform can unlock its potential.

In the past decade, healthcare has become one of the most dynamic industries for M&A deals, with global transactions valued at over [$200 billion every year](https://www.spglobal.com/marketintelligence/en/news-insights/latest-news-headlines/54645340) since 2014. M&A activity has ranged from mega-mergers brokered by private equity to independent hospitals trying to seize economies of scale by joining a local hospital system.

The healthcare merger and acquisition market is expected to remain robust in the coming year. In a [2019 Merrill Insights survey](https://hitconsultant.net/2019/05/29/healthcare-ma-survey-health-it-represents-the-richest-opportunity-in-sector/#.Xg4VbBdKhTZ) of global M&A professionals, 52% believed that the healthcare M&A market is headed in a positive direction in 2020, driven by the healthcare IT sector. Yet 40% of respondents said that data connectivity is the single greatest obstacle to harnessing opportunities in healthcare M&A.

So why is data the sticking point? Because while data should be an asset in healthcare mergers and acquisitions, trying to integrate IT in the wake of a deal can be a frustrating, resource-draining process that remains uncompleted even years after a merger has taken place.

Healthcare companies that want to position themselves for successful M&A deals need to make data integration a primary consideration, but in vast systems riddled with legacy applications in which HIPAA compliance is always a concern, it can be difficult to know where to start. The answer is Identity and Access Management (IAM): the central nervous system running through a healthcare company's operations.

## IT Integration Can Make or Break Healthcare M&As
Margins for healthcare companies, especially hospitals, are often razor-thin, so the success of an M&A transaction depends on being able to quickly capitalize on cost-saving synergies. But when data remains siloed, then integration never fully occurs, and that’s a missed opportunity for improved revenues and patient outcomes.

According to [Deloitte](https://www2.deloitte.com/us/en/pages/life-sciences-and-health-care/articles/healthcare-it-mergers-and-acquisitions-technology.html): “IT is typically the largest investment cost in the broader integration of health care systems. And it also accounts for roughly 70 percent of all synergies in the process.” Yet often, IT integration is treated as an afterthought, with no clear chain of command for overseeing it and a shortage of qualified developer talent to manage it.

For example, an analysis of American hospital data by [_Health Affairs_](https://www.healthaffairs.org/do/10.1377/hblog20190304.998205/full/) found that at hospital mergers and acquisitions, only a third of acquired hospitals switched to the electronic health record (EHR) provider of their acquirer, and 44% continued using a separate EHR system.

Broadly, healthcare companies have two options for dealing with IT integration during a merger or acquisition: the so-called “rip and replace” approach, where one entity scraps their existing software and adopts the software of the other health system, or interfacing, in which the two companies attempt to share data over separate systems. The former option can be extremely costly, and the latter can be extremely time-consuming, especially for healthcare companies using legacy or in-house software that is challenging to integrate.

## The Right IAM Solution Saves Time and Money

Using a modern IAM platform to approach the data integration challenge in healthcare M&As lets companies start sharing data across different systems immediately, creating a unified view of patients and staff. By treating identity (of patients, clinicians, and administrators) as the crucial element, rather than trying to align each individual application, a sophisticated IAM platform provides a clear path through the data jungle.
<include src="TweetQuote" quoteText="Faced with merging data during a healthcare merger? Find out why IAM is the place to start."/>
Auth0’s platform offers [turnkey enterprise federation](https://auth0.com/healthcare/) that can integrate with Active Directory, PingFederate, LDAP, or custom SAML-P providers. This enables healthcare providers to connect multiple directories, combining the data from each to create a single source of truth about patients. This gives clinicians across a healthcare system a holistic look at a patient’s history, which lets them make more informed care choices, faster.
![healthcare](https://images.ctfassets.net/kbkgmx9upatd/6T68NBcnHGWYCeqs8qeq2/e38e804ab0a26e3816cb03ba91fc103b/healthcare-phi-illustration.svg)
An IAM platform can also enrich the patient experience during a merger by creating a user-friendly patient portal they can navigate easily to look at their health plans, health insurance issues, and seek care within the medical system.

By implementing an extensible IAM solution like Auth0, you can make your healthcare organization much more attractive for M&As because you won’t waste precious developer time trying to integrate systems. Instead, you can put the right data in the hands of clinicians, administrators, and patients without forcing anyone to adapt to new software.

## Use IAM to Keep Data Secure During M&As

Personal Health Information (PHI) is a valuable asset for healthcare companies, but its intensely personal nature means that it can also be a liability, if not carefully protected. Increasingly, M&A dealmakers are making data security a part of due diligence to ensure they’re not acquiring a security nightmare. A successful M&A strategy requires an acquired company to prove from the outset that their [data is in order](https://www.docsend.com/blog/data-driven-approach-deal-management-good-everyone/) and ensure that it remains secure during the integration process.

Any IAM platform that handles PHI should be HIPAA-compliant, but Auth0 goes even further in protecting PHI from breaches that can lead to [costly fines and lawsuits](https://auth0.com/blog/8-ways-to-avoid-healthcare-breaches/). That’s more vital than ever with the rise of cyberattacks and global privacy legislation like [GDPR](https://auth0.com/docs/compliance/gdpr) in the EU and CCPA in the United States. In particular, medical identity theft is a growing concern, with [87,765 reported cases in 2018](https://www.cnbc.com/2019/06/07/how-to-avoid-medical-identity-theft.html). And in July 2019, [Quest Diagnostics](https://www.cnbc.com/2019/06/07/how-to-avoid-medical-identity-theft.html) revealed that the personal information of 11.9 million patients had been compromised by an unauthorized user.
<include src="TweetQuote" quoteText="Medical identity theft raises real threats during a healthcare M&A. Learn why IAM can be the right prescription."/>
These sorts of breaches are the result of poorly managed access to data: insufficient login requirements, unencrypted records stored in the wrong place, and inappropriate permissions assigned to staff members and third parties. The risk of these policies leading to a breach is exacerbated during an M&A when staff turnover is high and data is in transit. But with the right IAM platform, you can manage access to PHI throughout the transition period. With a user dashboard, you can see who has access to data and implement increased security protocols wherever you choose.

<include src="asides/AboutAuth0" />

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4jTBX21IwfoVe0hK9Jys4D/7bfcdf1a6525ef6a115dafcd8576402e/auth0-dashboard)

If a clinician attempts to log in from a new device, you can employ [multifactor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) to ensure they’re who they claim to be. And if a staff member exits the company, you can revoke their access with the flip of a switch.

## Healthcare M&As Need IAM Solutions
Healthcare M&A deals have the potential to deliver value for stakeholders and improved outcomes for patients, and that potential is precisely why the healthcare industry has seen such a high deal volume in recent years. But delivering on this promise requires healthcare companies to treat data as a core asset in any deal and be equipped with the right tools to put that data to work.

[Deloitte’s 2018 report](https://www2.deloitte.com/us/en/pages/life-sciences-and-health-care/articles/healthcare-it-mergers-and-acquisitions-technology.html) on healthcare M&A concluded that “If IT is not baked into the earliest stages of M&A, carefully considered in due diligence, [and] planned for in integration strategies...provider organizations can find themselves...with spiraling IT costs and mounting frustration for lack of efficiencies gained, putting the future in serious doubt.”

If you’re in the healthcare M&A market, and you’d like to address any doubts you have about your data governance, reach out to the [experts at Auth0](mailto:sales@auth0.com).

Why IAM Is the Prescription for Healthcare M&As

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

Oracle CX Commerce customers can now leverage the Auth0 Platform.

**TL;DR:** In this article, we are going to discuss how Oracle CX Commerce and Auth0 can now be connected! We will walk through that process to see just how we can accomplish that!

## Auth0 + Oracle CX Commerce

Auth0 and Oracle have partnered together to find a great opportunity that brings added value to our users. Oracle and Auth0 now empower customers to leverage the Auth0 platform to add identity and access management capabilities to commerce storefronts that are built and hosted on CX Commerce.

## Oracle CX Commerce 

Okay, but what is Oracle CX Commerce? CX Commerce is a leading enterprise SaaS commerce solution -- scalable, flexible, cloud-native, and built to support both B2B and B2C. Want to build an enterprise, highly customizable, feature-rich digital commerce business? CX Commerce’s solution provides for all of that! 

<include src="TweetQuote" quoteText="Auth0 and Oracle have partnered together to find a great opportunity that brings added value to our users."/>

## Why Use Auth0 and Oracle CX Commerce Together

Auth0 brings a level of identity and authentication that can benefit many Oracle CX Commerce customers, including [social sign-on](https://auth0.com/learn/social-login/)! Auth0 has a large list of social networks to choose from that can easily be plugged into an online store. Merchants can choose from Facebook to LinkedIn, whichever social network makes sense for the audience of the website! Whether B2B or B2C, the integration is easy to use for shoppers and business partners.

Auth0 can add:

* Registering for a new account
* [Single Sign-On](https://auth0.com/single-sign-on) (SSO) for Oracle CX Commerce-powered apps
* Social Sign-On

By adding in Auth0, we can also configure a CX Commerce app and set up SSO for both Social and Enterprise connections!

How will this help improve customer satisfaction? This is a very customizable and global solution that many customers have been waiting for. For example, there are merchants in APAC that want this solution because the current registration requires an email. Many APAC countries have people registering for sites using their mobile phone number. If the shopper wants to use their Facebook or Twitter account to log into the website, this is now possible!

And wherever your shoppers are in the world, being able to log into a storefront via Facebook, Amazon, Google, or other accounts increases conversions. It improves the overall experience by eliminating an additional barrier to browsing or placing an order.

This partnership between Oracle CX Commerce and Auth0 is destined to deliver innovative solutions that help improve business and shopper experience.

<include src="TweetQuote" quoteText="By adding in Auth0, we can also configure a CX Commerce app and set up SSO for both Social and Enterprise connections!"/>

## How to Connect Oracle CX Commerce and Auth0

In this next section, let's go over how to connect Oracle CX Commerce and Auth0.

## Configure Oracle CX Commerce SSO

### Enable Single Sign-On on the Oracle CX Commerce instance

The first thing we need to do is enable SSO on our Oracle CX Commerce instance. We can use a `PUT` request on the `/ccadmin/v1/merchant/samlSettings` endpoint to enable it with some options.

We will want to configure all the security features, such as assertion encryption as well as request and response signatures.

```http
PUT https://ccadmin-{{env}}.oracleoutsourcing.com/ccadmin/v1/merchant/samlSettings
 {
 "enabled": true,
 "nameIdPolicyFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
 "requireEncryptedAssertions": true,
 "requireSignedResponse": true,
 "signAuthnRequest": true,
 "nameIdPolicyAllowCreate": true
 }
```

### Configure Cross-Origin Resource Sharing (CORS) to allow access to resources from Auth0 servers

The following `PUT` request on the `/ccadmin/v1/sites/siteUS` (use your Site ID) will allow access to resources from outside the domain. This will return two URLs: the Auth0 URL and a URL for Facebook Social Login.

```http
PUT https://ccadmin-{{env}}.oracleoutsourcing.com/ccadmin/v1/sites/siteUS
  {
    "properties": {
    "allowedOriginMethods": {
      "https://login.eu.auth0.com" : "POST",
      "https://dev-e3psebdq.eu.auth0.com": "POST"
    }
  }
}
```

### Retrieve Service Request Entity Descriptor for the Storefront instance

We can retrieve the whole Service Request Entity Descriptor for our Storefront instance using a `GET` request on the `/ccstore/v1/merchant/samlSettings` endpoint.

The Entity Descriptor is returned in the `spEntityDescriptor` field.

```http
GET https://ccstore-{{env}}.oracleoutsourcing.com/ccstore/v1/merchant/samlSettings
 {
 "spEntityDescriptor": "<?xml version=\"1.0\" encoding=\"UTF-8\"standalone=\"no\"?>
 <md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" 
 entityID=\"https://ccstore-z7ta.oracleoutsourcing.com[…Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" 
 Location=\"https://ccstore-z7ta.oracleoutsourcing.com/SAMLpost\" 
 index=\"1\" isDefault=\"true\"/>
 </md:SPSSODescriptor>
 </md:EntityDescriptor>",
 "links": [
 {
 "rel": "self",
 "href": "https://ccstore-z7ta.oracleoutsourcing.com/ccstore/v1/merchant/samlSettings"
 }
 ]
}
```

Above is a formatted version of the `spEntityDescriptor` field. We will find the application SAML callback URL in the `Location` attribute of the `md:AssertionConsumerService` tag.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://ccstore-
z7ta.oracleoutsourcing.com">
 <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 <md:KeyDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" use="encryption">
 <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
 <dsig:X509Data>
 <dsig:X509Certificate>MIIDUjCCAjqgAwIBAgIEFV[…]xFQQXQ\nWt8ObeT8vQdOLn9t4ZnXevMY3MV EsjMbFQUu99mngLR1h9mG7C4=\n</dsig:X509Certificate>
 <dsig:X509IssuerSerial>
 <dsig:X509IssuerName>CN=ops</dsig:X509IssuerName>
 <dsig:X509SerialNumber>358591734</dsig:X509SerialNumber>
 </dsig:X509IssuerSerial>
 <dsig:X509SubjectName>C=US, ST=California, L=Redwood City, O=Oracle Corporation, OU=tz7ta0c0, CN=tenant_tz7ta0c0</dsig:X509SubjectName>
 <dsig:X509SKI>wwGRZXxfpezbTIFzTqCB+gFO+hU=\n</dsig:X509SKI>
 </dsig:X509Data>
 </dsig:KeyInfo>
 </md:KeyDescriptor>
 <md:KeyDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" use="signing">
 <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
 <dsig:X509Data>
 <dsig:X509Certificate>
MIIDUjCCAjqgAwIBAgIEFV[…]xFQQXQ\nWt8ObeT8vQdOLn9t4ZnXevMY3MVEsjMbFQUu99mngLR1h9mG7C4=\n
 </dsig:X509Certificate>

 <dsig:X509IssuerSerial>
 <dsig:X509IssuerName>CN=ops</dsig:X509IssuerName>
 <dsig:X509SerialNumber>358591734</dsig:X509SerialNumber>
 </dsig:X509IssuerSerial>
 <dsig:X509SubjectName>C=US, ST=California, L=Redwood City, O=Oracle Corporation,OU=tz7ta0c0, CN=tenant_tz7ta0c0
 </dsig:X509SubjectName>
 <dsig:X509SKI>wwGRZXxfpezbTIFzTqCB+gFO+hU=\n</dsig:X509SKI>
 </dsig:X509Data>
 </dsig:KeyInfo>
 </md:KeyDescriptor>
 <md:NameIDFormat xmlns="urn:oasis:names:tc:SAML:2.0:metadata">urn:oasis:names:tc:SAML:2.0:nameid-
format:persistent</md:NameIDFormat>
 <md:AssertionConsumerService xmlns="urn:oasis:names:tc:SAML:2.0:metadata" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://ccstore-z7ta.oracleoutsourcing.com/SAML/post" index="1" isDefault="true" />
 </md:SPSSODescriptor>
</md:EntityDescriptor>
```

### Add the SAML Login/Registration Widget to the Header Widget

Now that CX Commerce is configured, we can replace the standard Login/Registration Widget. We can find that in the Header Widget along with the SAML Login/Registration Widget. This will redirect users to our Auth0 login screen when they click the Login link.

![Oracle Header Widget](https://images.ctfassets.net/23aumh6u8s0i/3ZByTVdLqC0uxKKzp3V7L6/ed8ff99e3e41ae3b0130d4191a3729e9/header-widget)

## Configure Auth0 Application and SAML2 Add-On

### Create and configure an application in Auth0

If we visit [Auth0.com](https://auth0.com/), we can start the application process. If we do not already have an account, we can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

1. Go to our [**Auth0 Dashboard**](https://manage.auth0.com/#/) and click the "[Create Application](https://manage.auth0.com/#/applications/create)" button.
2. Name our new app (Oracle CX Commerce), select "Single Page Web Applications", and click the "Create" button.
3. In the **Settings** for our new Auth0 app, add `https://ccstore-xxx.oracleoutsourcing.com/SAML/post` to the **Allowed Callback URLs**.
4. Add `http://localhost:[PORT]` to the **Allowed Logout URLs**. This will be the link we want the user directed to when they hit log out.
5. Click the "Save Changes" button.

### Configure the SAML 2 Web App add-on in Auth0

Once the application is configured, we can enable the SAML 2 add-on. If we were to click on "Addons", right next to the "Settings" tab for our application, we will see the option for "SAML 2 Web App". Click on the button that toggles, and a modal will appear.

Within that modal, we will want to add in our "Allowed Callback URL" into the spot for "Application Callback URL": `https://ccstore-xxx.oracleoutsourcing.com/SAML/post`

We can then configure additional security features in the settings, such as signing responses and importing CX Commerce certificates for handling signed requests.

The certificate is the one found in the storefront entity descriptor extracted earlier.

```json
{
 "signatureAlgorithm": "rsa-sha1",
 "digestAlgorithm": "sha1",
 "signResponse": true,
 "signingCert": "-----BEGIN CERTIFICATE-----\nMIIDUjCCAjqgAwIBAgIEFV[…]xFQQXQ\nWt8ObeT8vQdOLn9t4ZnXevMY3MVEsjMbFQUu99mngLR1h9mG7C4=\n-----END CERTIFICATE-----\n"
}
```

Next, click on "Usage" at the top of the modal and we will find all the information we need to finalize the configuration in Oracle CX Commerce.

Here we can download the "Identity Provider Metadata" that will be uploaded to CX Commerce.

Our Auth0 Entity Descriptor will look like:

```xml
<EntityDescriptor entityID="urn:dev-e3psebdq.eu.auth0.com" 
 xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
 <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 <KeyDescriptor use="signing">
 <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
 <X509Data>
 <X509Certificate> MIIDDTCCAfWgAwIBAgIJGkJ2[…]8hn9WIe2Uj6rqrINzyhHclXVdRzy1F8EQ5q/+Z1ECF9Bc1I8sqFQk=
 </X509Certificate>
 </X509Data>
 </KeyInfo>
 </KeyDescriptor>
 <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://dev-e3psebdq.eu.auth0.com/samlp/8kVhBa7Sn84ejet98w634wAGlNi9N5AW/logout" />
 <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dev-e3psebdq.eu.auth0.com/samlp/8kVhBa7Sn84ejet98w634wAGlNi9N5AW/logout"/>
 <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
 <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
 <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
 <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://dev-e3psebdq.eu.auth0.com/samlp/8kVhBa7Sn84ejet98w634wAGlNi9N5AW"/>
 <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dev-e3psebdq.eu.auth0.com/samlp/8kVhBa7Sn84ejet98w634wAGlNi9N5AW"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="E-Mail Address" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Given Name" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Name" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Surname" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Name ID" 
 xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>
 </IDPSSODescriptor>
</EntityDescriptor>
```

### Configure SAML Mapping Rule in Auth0

To be able to match the existing user in Oracle CX Commerce, we need to change the SAML mapping to map the "nameidentifier" field with the email address. We can do this by creating a rule in Auth0.

If we click on "Rules" in the menu on the left in the Dashboard, we will then see a "+Create Rule" button. Hit that button. We will then see a list of rules we can use.

Scroll down to find the rule titled: _SAML Attributes mapping_

Here is the code for the final rule:

```javascript
function (user, context, callback) {
  context.samlConfiguration.mappings = {
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "email",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "email",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "name",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/food": "user_metadata.favorite_food",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/address":
    "app_metadata.shipping_address"
  };

  callback(null, user, context);
}
```

Hit "Save Changes" when done.

![Rules Dashboard with SAML Attributes mapping active](https://images.ctfassets.net/23aumh6u8s0i/6HzBsBIFoUNmmalCMin5C8/026768a8e4a1a1305bdf7628114ef97d/saml-attributes-mapping)

### Force Email Verification in Auth0

We may want to add in email verification to our application. That's also an Auth0 Rule!

If we return to our Rules Dashboard, we can add another rule by clicking the "+Create Rule" button again. Find the "Force email verification" and click on it.

Here is the code for the final rule in Auth0:

```javascript
function (user, context, callback) {
  if (!user.email_verified) {
    return callback(new UnauthorizedError('Please verify your email before logging in.'));
  } else {
    return callback(null, user, context);
  }
}
```

So now, when the user registers to Auth0 using a username/password method instead of the social media route, they will receive an email that will allow them to verify their email address via a link.

## Configure Social Connections in Auth0

### Enable a new social connection in Auth0

Now that we have SAML 2 configured in Auth0 let's add in Social Connections!

If we were to click on "Connections" and then "Social", we would be at the Social Connections page within our Auth0 Dashboard.

Here, we can turn on Facebook social connections for one or many of our Auth0 apps. We will be directed to a modal that will show us our list of applications. Be sure to turn it on for this application!

We will need to add in our App ID and App Secret. To learn more about this, please [visit this document](https://auth0.com/docs/connections/social/facebook).

## Conclusion

With Oracle CX Commerce and Auth0 connected, developers and customers can see huge benefits. Having Social Login capabilities makes shopping easier for customers and improves conversion rates for merchants. Auth0 helps enable social sign-on, plus other rules and benefits, to be added easily to Oracle CX Commerce digital experiences. 

<include src="asides/AboutAuth0" />

---

How to Integrate Auth0 with Oracle CX Commerce

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Why KuppingerCole says using identity as a point solution isn’t good enough


Digitization creates complexity. Your legacy systems must be depreciated, migrated, or modernized. Your data must be cleansed, consolidated, and used in new ways. Meanwhile, customers are engaging with you on new channels and [input-constrained devices](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/) but expect not to have to reset their password or sacrifice a good user experience. And your partners want to keep their access to critical data in your systems without interruption.

Identity can help – but only if you approach it the right way.

Identity management is often a critical missing piece when it comes to digitizing services. The main reason is that many companies use identity as a point solution for one area of the business. Think social login for a single app or profile enrichment functionality that never reaches the ears of the marketing team.

But digital transformation isn’t an isolated project. If you want the full value of identity, all digital services need to use the same identity platform. Identity should be a strategic service in your digital infrastructure that all applications can use again and again, without having to reinvent the wheel. Your developers will thank you, and you’ll get to market faster, innovate more, be more secure, and lower your maintenance costs.

You can develop an action plan for thinking about identity from a platform perspective in a new whitepaper from KuppingerCole and Auth0 titled, “[Do Identity Right – So Your Digital Business Strategy Succeeds.](https://auth0.com/resources/whitepapers/identity-digital-business-strategy)” 

In this post, we explore some of the key concepts. You can download the full whitepaper in [**English** here](https://auth0.com/resources/whitepapers/identity-digital-business-strategy) and [**German** here](https://auth0.com/resources/whitepapers/identitaeten-digitale-geschaeftsstratgie). 

## Introducing: Identity API Platforms

Digital transformation creates fragmented systems which ultimately need to talk to each other and to customers and partners if you want your digital business to succeed. APIs, or Application Program Interfaces, are a powerful solution, and this year KuppingerCole established a new IT market segment – Identity API Platforms – for vendors in this space.

![KuppingerCole IAM market segment](https://images.ctfassets.net/23aumh6u8s0i/3PEdsuBc6DbhoLfucQXT4c/57006aea0d2b17a2b90035d06daf1dae/iam-market-segment)
_Source: KuppingerCole_

Identity API Platforms support the requirements of IAM, Federation, IDaaS, CIAM, and more with a focus on being developer-centric. They are ideal for providing identity management in agile, DevOps, and more complex IT environments. “The resulting benefits of relying on an Identity API Platform are apparent,” says Martin Kuppinger, KuppingerCole founder and author of the whitepaper. “They allow for efficient implementation and re-use of identity services across all the various digital platforms and services an organization is creating.”

Kuppinger adds: “Auth0 counts amongst the leading providers of Identity API Platforms, with a cloud-based offering that delivers extensive API support specifically around the authentication and authorization of users.” 

We’re proud that Auth0 was also named an Overall Leader in KuppingerCole’s inaugural [Leadership Compass for Identity API Platforms](https://auth0.com/blog/auth0-named-overall-leader-kuppingercole-leadership-compass), which notes the strength of our developer tools, online support, and overall ecosystem.

## Architecting for Scale

“Today’s established software paradigm is centered around creating microservices with well-distinguished capabilities,” says Kuppinger. “This not only includes services for business functions, but also the underlying capabilities such as authentication, user management, encryption, or other identity and security services.” 

If you want to prepare your business for scale, avoid monolithic architectures. Instead, think in best-of-breed services that can talk to each other via APIs. Taking this approach for identity – exposing identity services as an API layer – will help you be more agile and flexible. Applications can consume these services instead of creating their own.

## Auth0 as Your Strategic Identity Platform

“Auth0 is well-positioned to become the identity platform for digital applications, for any type of organization.” – Martin Kuppinger, KuppingerCole

Whether you’re in a continued state of digital transformation or a digital native focused on building your core product, you understand the importance of answering who should have access to what. A centralized, platform-based identity solution will help you make your digital business strategy a reality. Auth0 is one of the leading global providers in this space and has been recognized by KuppingerCole as a [market and technology leader in CIAM](https://auth0.com/resources/webinars/kuppingercole-leadership-compass-for-ciam), and Identity-as-a-Service (IDaaS) and Identity API Platforms. 

[Download the whitepaper](https://auth0.com/resources/whitepapers/identity-digital-business-strategy) to learn more about doing identity right for the digital business.

[Register for the upcoming webinar](https://auth0.com/resources/upcoming-webinars/do-Identity-right-kuppingercole/) with Martin Kuppinger, Founder and Principal Analyst at KuppingerCole.


Building a Digital Business Needs a Platform-Approach to Identity

Consecutive reports highlight the breadth of Auth0’s identity capabilities

**LONDON – Sept 3, 2019 –** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has been selected as an Overall Leader in two KuppingerCole Analysts Leadership Compass reports – IDaaS Access Management and Identity API Platforms. The IDaaS research report evaluates vendors delivering cloud-based access management capabilities, and the new Identity API Platforms report focuses on using APIs to provide identity management in agile, DevOps, and more complex IT environments.

Digital transformation is driving the need for APIs to link different systems and services together to create a seamless experience. Identity API Platforms is a new segment established by KuppingerCole to evaluate vendors that are solving this need. By exposing key identity functionality via APIs, Identity API Platforms support the requirements of IAM, Federation, IDaaS, CIAM, and more with a focus on being developer-centric.

Auth0 is positioned as an Overall Leader in both Identity API Platforms and IDaaS Access Management. According to Martin Kuppinger, founder of KuppingerCole, “Auth0, with its rich set of APIs and SDKs, is an extremely developer-friendly IDaaS AM service that offers rapid deployment and is forward-leaning in its approach to create and support a flexible identity ecosystem.”

Kuppinger adds: “Organizations seeking a developer-friendly IDaaS platform with great extensibility, support for open standards, DevOps, and microservices should consider Auth0 on their shortlist.” KuppingerCole also named Auth0 an Overall Leader in the 2018 [Leadership Compass for Consumer Identity Access Management (CIAM)](https://auth0.com/resources/whitepapers/leadership-compass-for-ciam).

“Today’s API-driven economy is a primary driver of Auth0’s ongoing growth and represents a significant portion of our business,” said Eugenio Pace, CEO and co-founder of Auth0. “Our placement in these reports is further validation of our overall approach and our focus on the builders of applications. We are grateful to KuppingerCole for the recognition.”

Develop an action plan for thinking about identity from an API platform perspective vs. a point solution in a new whitepaper from KuppingerCole and Auth0: “[Do Identity Right – So Your Digital Business Strategy Succeeds.](https://auth0.com/resources/whitepapers/identity-digital-business-strategy)”

<include src="asides/AboutAuth0" />

### Media Contacts

Mark Fowler 
Racepoint Global for Auth0, EMEA 
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)

Auth0 Named Overall Leader in KuppingerCole Leadership Compass Reports for IDaaS and Identity API Platforms

Technology enhances security for lenders and financial partners using the Kiva.org platform

**BELLEVUE, Wash. -- August 27, 2019 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that it is powering the authentication for [Kiva](https://www.kiva.org/), the international nonprofit dedicated to expanding financial access to help underserved communities thrive. Auth0's platform will provide secure web authentication for Kiva's growing global community of nearly two million lenders across more than 190 countries.

Kiva is the world's first and largest crowdfunding platform for social good, and has crowdfunded more than $1.3 billion in microloans to more than three million entrepreneurs worldwide since its founding in 2005. Kiva believes that lending is one of the most powerful and sustainable ways to make a positive impact on people's lives.

In response to its rapid growth, Kiva decided to transform its authentication platform to better serve its global audience of lenders who process a high number of transactions on a daily basis. Auth0 was selected after a careful review of many factors, including the robustness of the platform, ability to support compliance regulations, and added security features such as multifactor authentication and anomaly detection.

"People all around the world are looking to secure loans to help better themselves — and the individuals and organizations that are looking to provide these loans need a secure way to do so," said Van Mittal-Henkle, principal software engineer at Kiva. "It is essential that the authentication platform we have in place to help facilitate these loans is secure, flexible, and able to take on our continually expanding base of lenders and lending partners. We are pleased to have found that comprehensive solution in Auth0."

"Kiva is a perfect example of how technology can have a very substantial impact on the overall outcome of social good," said Eugenio Pace, CEO and co-founder at Auth0. "We are so thrilled to be working with an organization whose sole mission is to better people's lives, and are fully prepared to authenticate growing numbers of users as Kiva further broadens its lending network."

Learn more about [Kiva's implementation](https://auth0.com/case-studies/kiva-implements-auth0-rules-mfa/) on Auth0.com.

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk 
Corporate Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com)

Meghan Gardner 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Powers Authentication for Kiva’s Global Crowdfunding Platform for Social Good

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Strengthen your authentication, threat detection, and volume capabilities before the games.

![Tokyo 2020 Emblems](https://tokyo2020.org/assets/img/pages/games/emblem/emblem.jpg)

[_Source: Tokyo 2020 Emblems_](https://tokyo2020.org/en/games/emblem/)

The [Tokyo 2020 Olympics](https://tokyo2020.org/en/) might seem far away — yet for lead engineers in charge of streaming the games, it’s not far enough.

Tokyo will have a total of [_33 official sports_](https://www.nbcnews.com/news/world/tokyo-2020-summer-olympics-everything-you-need-know-n849301) — five more than the Rio Summer Olympics in 2016. In particular, new sports like surfing, skateboarding, sport climbing, and karate target younger viewers who are accustomed to watching sports (and e-sports) online, uninterrupted, and at high resolution. 

In 2018, major broadcasters like NBC streamed [_thousands of hours_](https://techcrunch.com/2017/11/16/nbc-will-live-stream-a-record-1800-hours-of-the-2018-winter-olympic-games/) of events. The BBC broke viewing records with [22.2 million streams](https://www.bbc.co.uk/mediacentre/latestnews/2018/most-streamed-winter-olympics-to-date). The pressure is on in 2020 to reach and impress an even larger audience.

Delivering a high-quality Olympic viewing experience is an enormous challenge from both a bandwidth and a security point of view. [Over 100 million unique users](http://www.nbcuniversal.com/press-release/nbc%E2%80%99s-rio-olympics-most-successful-media-event-history) watched the Olympics across NBC’s digital platforms alone in 2018 — nearly a 30% jump over London’s 2012 games. Users logged in to watch the games on-the-go and on myriad devices. NBC had to build out its operations and rely on more than 1,100 staff to maintain consistent service. 

Since then, the risks for video streamers have become more visible and acute. [In February of 2019](https://techcrunch.com/2019/01/02/chromecast-bug-hackers-havoc/), hackers exposed a vulnerability in Chromecast streaming devices that allowed them to play any video they wanted. More recently, on March 2019, free movie streaming site Kanopy disclosed a [significant breach](https://www.digitaltrends.com/home-theater/kanopy-streaming-data-breach/) of its users’ personal information, including geolocation, device type, and IP address. Hackers know how popular subscription streaming services are today — and are anticipating the 20-day bump that will start next July. 

Below, we offer three ways to future-proof your team’s streaming system, so you can deliver the safe yet thrilling experience your users expect.

## 1. Seamlessly and Securely Authenticate Your Users

Many users watching the 2016 Rio Games online were disappointed. Poor buffering, slow load times (occasionally [_up to 4 hours_](https://www.theverge.com/2016/8/26/12646224/nbc-rio-olympics-2016-coverage-tv-ratings-streaming) in parts of the U.S.), and mediocre in-app experiences caused frustration. Live streaming has been a major part of the Olympic experience since the 2008 Beijing Games. After more than a decade, it’s difficult to excuse subpar services.

Staggered visuals and outages are more than embarrassing. They can lead to declines in user engagement and revenue loss if advertisers seek other platforms.

One way to quickly and significantly improve your user experience is to implement better authentication measures. If a user is pleased with a simple, frictionless initial login — and can access content easily thereafter — it sets the stage for a rewarding, long-term relationship.

A third-party service like Auth0 can help you seamlessly implement features like [_single sign-on_](https://auth0.com/single-sign-on) (SSO) that make authentication painless and highly effective. Particularly when users require access to several applications simultaneously or in quick sequence, SSO allows them to simply log in once — regardless of their platform, technology, or domain.

![Example of single sign-on across apps](https://images.ctfassets.net/23aumh6u8s0i/3lzfDU5IDcS7PMe04OFltU/1fa68a5d13fc8e4160bd58f495d9525b/example-of-single-sign-on-across-apps)

Auth0’s SSO feature has [built-in security certifications](https://auth0.com/single-sign-on), including OpenID Connect, OAuth 2, and LDAP. In addition, it’s already SOC 2 and GDPR compliant — so if you’re concerned about protecting a volume of customer data, Auth0 can help with much of the heavy lifting.

Another way to offer your users smooth authentication and authorization is [Device Flow](https://auth0.com/device-flow/), a fast, easy, and safe way to log into limited-input devices. Auth0 offers a fully compliant implementation of the [OAuth 2.0 Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/) so you can take advantage of the security and user experience benefits of a standard delegated authorization protocol.

Taking the time to create a richer user experience doesn’t have to be a drain on your resources. Zeroing in on a pain point like authentication can improve multiple issues simultaneously — making you at once more organized, more secure, and more delightful to your audience.

## 2. Detect Threats before They Snowball 

Cybercrime is on the rise — and according to [_recent data from Akamai_](https://www.akamai.com/us/en/about/news/press/2019-press/state-of-the-internet-security-credential-stuffing-attacks-and-economies.jsp), streamers have emerged as top targets.

In this challenging environment, which will likely become even more dangerous leading up to 2020, it’s critical to take every precaution to protect the customers on your platform.

Simple yet powerful [_anomaly detection features_](https://auth0.com/docs/anomaly-detection) can help you quickly catch common threats — and take immediate action to block their progression. 

Auth0’s [_brute-force shield_](https://auth0.com/docs/anomaly-detection#brute-force-protection), for example, triggers after a set number of failed login or sign up attempts from the same IP address. The shield automatically notifies the administrator, who can immediately respond.

![Image of Auth0 Brute Force Shield](https://images.ctfassets.net/23aumh6u8s0i/4TwHT9UbSxQY9znGFp4p16/f05467dc9a90258258d9c44ff1e38143/image-of-auth0-brute-force-shield)

On the back end, admins can tailor their response to a suspected attack in a number of ways, including:

* Blocking the suspicious IP address
* Sending a [_customized email_](https://auth0.com/docs/anomaly-detection/references/brute-force-protection-triggers-actions#customize-the-blocked-account-email) to the affected user, and/or
* Whitelisting the account, so it doesn’t erroneously trigger a reply in the future

If admins are able to verify the user’s identity and resolve the issue, they can also easily remove the block via an email link.

A tool like brute-force protection is particularly useful with subscription services — where major data leaks have left [millions of user credentials exposed](https://www.troyhunt.com/pwned-passwords-version-5/) to hackers. 

With this cache of personal information, it’s easy for cybercriminals to develop algorithms that churn through username/password combinations — rapidly testing them against a login screen — until they gain access. 

The bad news is that since consumers worldwide expect to [_increase their number of subscriptions_](https://www.emarketer.com/content/which-subscription-services-will-us-consumers-sign-up-for-next), the surface area for such attacks continues to widen. The good news is that it’s not hard to bolster or build your platform to keep these attempts in check. Offloading this specific concern to a third party can also free up your technical talent to focus on larger, more complex tasks that directly relate to your efforts to scale.

## 3. Easily Handle Increased Volume

Even if you’ve developed a winning UX and strengthened your platform against major attacks, video streamers still face the challenge of making sure their service is robust enough to handle the surge in viewers expected for the Olympics.

Now is the time to be updating legacy systems, load testing, and determining specific gaps so that you can make necessary changes in time for Tokyo.

One way to do this is to develop your technology in-house. This has the potential to give you more ownership and flexibility over your outcomes. Yet many teams can’t afford to dedicate the time and engineers required to make these systemic changes. 

A second option is to buy your solution. In this case, it’s critical to find technology you can tailor to fit your needs. Every company is different — and will have different needs as it evolves. There is no one-size-fits-all product or suite of products that instantly delivers on volume, security, and design.

For this reason, at Auth0, we’ve built flexibility into our core. Every tool and feature we provide comes with [extensions](https://auth0.com/docs/extensions) — ways to run commands/scripts that enlarge the functionality of the base product. Whether it’s SSO, anomaly detection, advanced authentication features, or tools for better [user management](https://auth0.com/user-management) — Auth0 has specific [Rules](https://auth0.com/docs/rules) and [Hooks](https://auth0.com/docs/hooks) that adapt our technology to serve yours. 

## Be a Team Player

Preparing your platform for an enormous uptick in demand and increasing security threats — all while remaining fun and easy-to-use on the front end — might seem like an unwieldy and expensive task. 

Whether you build or buy the solutions you need, you’ll be dedicating significant financial and human resources in a tight time frame. Partnering with a team who has done this before can make all the difference — and the [ROI](https://auth0.com/forrester-total-economic-impact/) is often much higher than teams think. 

You’ll speed up time to implementation, reduce security costs, and free your engineers to double down on core, revenue-driving products. 

You don’t have to dread the Olympics. If you update your platform now, by the time 2020 rolls around, you too could be in the audience.

<include src="asides/AboutAuth0" />

3 Ways to Scale Your Streaming Platform Before Tokyo 2020

Online travel agency authenticates millions of users across multiple platforms with Auth0

<div class="alert alert-info alert-icon">
 Download Press Release as PDF 
 <a href="https://cdn.auth0.com/blog/pdf/holidaycheck-makes-digital-identity-easier-for-users-final-eng.pdf">English</a> 
 <a href="https://cdn.auth0.com/blog/pdf/holidaycheck-erleichtert-digitale-Identifizierung-für-urlauber-final-de.pdf">German</a> 
</div>

**LONDON July 24, 2019** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that it has deployed its identity management platform for hotel rating and travel booking portal, [HolidayCheck](https://www.holidaycheck.de/).

In concrete terms, this enables users to simply, securely, and conveniently authenticate themselves via the portal's website or mobile app to book a holiday and submit ratings. In total, HolidayCheck has more than 1 million hotels, 9.4 million hotel ratings, and over 10 million photos and videos.

As the second-largest online travel agency in the German-speaking market, HolidayCheck deals with numerous users every day whose data must be managed securely and smoothly. This is particularly true during the holiday season, when users of the portal have to identify themselves to quickly book last-minute offers. HolidayCheck wants to strengthen trust and loyalty in the brand by accelerating the entire identity management process to offer its customers an Urlauber*-friendly service.

"Auth0's authentication solution allows us to quickly and easily authenticate millions of users each month across multiple platforms, so they can book their holiday with us without a long time delay and give feedback smoothly," says Björn Zapadlo, director of technology at HolidayCheck.

"It's great to work with like-minded individuals who are not only seeing value from your product, but also share your values as a company. A shared focus on trust makes our partnership with HolidayCheck that much better, and we look forward to helping them become the most holidaymaker-friendly company in the world," said Steven Rees-Pullman, GM of EMEA at Auth0.

The Auth0 solution has enabled HolidayCheck to handle more than 21 million authentication transactions in the last 30 days. With Auth0, Zapadlo and his team are improving their ability to personalise the online experience and bookings for many different types of buyers. More details on [HolidayCheck's implementation of Auth0 can be found here](https://auth0.com/case-studies/holidaycheck/).

_* Urlauber [uːɐlaʊbɐ] is the German term for vacationer, holidaymaker._

## About HolidayCheck

HolidayCheck enables every Urlauber to find and book the individually suitable holiday thanks to authentic evaluations, the expertise of their own travel agency, and the knowledge of the community. It is based on over 9.4 million hotel evaluations, its own TÜV-certified online travel agency with around 220 travel experts, and the offers of more than 100 tour operators and other tourism providers. Urlaubers can also find lots of helpful information and inspiration in the travel forum with up to 2.9 million visitors per month, in the HolidayCheck online magazine Away, and on the new HolidayCheck cruise platform. HolidayCheck AG, a subsidiary of the HolidayCheck Group, was founded in 2003 and is based in Bottighofen, Switzerland, near the German border town of Constance.

<include src="asides/AboutAuth0" />

### Media Contacts:

Silvia Hänig 
shaenig@wireside.com 
haenig@i-kom.org 
0173-3838572 
089-44848127 

Mark Fowler 
Racepoint Global for Auth0, EMEA 
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com) 
+44 (0) 77 1124 4113

"platform"