eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Senior Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Product Marketing Manager - Customer Identity Cloud

Eric Wu

Self-Service Single Sign-On (SSO) reaches General Availability (GA) status

As Independent Software Vendors (ISVs) quickly learn, in addition to building the core functionality of your software-as-a-service (SaaS) apps, you must also provide features that support your business customers’ administration, integration, and security needs.

One of the most challenging features to implement is Single Sign-On (SSO) due to the many competing standards and protocols available. Plus, merely supporting SSO is only one piece of the puzzle — it also has to get deployed:

* **From the perspective of each of your business customers**, setting up SSO for each and every app they’ve adopted can be a tedious process, often involving lots of back and forth with your customer service reps — and perhaps even your developers
* **For you as an ISV**, helping each and every business customer set up SSO for your app is just as tedious and time-consuming

Both parties benefit from a quick and simple deployment approach, which is why we’re excited to announce that our Self-Service SSO feature has reached General Availability (GA) status.

## SSO Is an Enterprise Imperative

Due to its associated benefits, Single Sign-On (SSO) — an Identity solution that allows multiple applications to use the same authenticated session — is an essential element of modern Identity and Access Management (IAM). SSO is so important, in fact, that it’s a foundational element of [the emerging Interoperability Profile for Secure Identity in the Enterprise (IPSIE) security standard](https://www.okta.com/blog/2024/10/oktane-2024-the-future-of-identity-security/).

On top of providing a convenient user experience, SSO dramatically reduces the number of credentials in use and helps to ensure that security policies are consistently applied across all of an organization’s applications, since the policies can be enforced at an organization’s Identity Provider (IdP).

Now that Identity has emerged as the primary enterprise security entry point, and with [organizations deploying more apps than ever before](https://www.okta.com/businesses-at-work/), SSO is needed more than ever.

### Simplifying SSO configuration saves time, reduces errors, and manages information risk

Self-service SSO refers to a flow that allows your business customers to set up and edit SSO connections themselves.

This capability delivers several valuable benefits, including:

* **Saving time for everyone:** Building Identity solutions isn’t your core business, and any time spent doing so pulls your team from product extension and innovation. With Self-Service SSO, your developers can focus more on your product instead of SSO integrations.
* **Reducing the potential for errors:** Manually configuring SSO introduces the risk of errors that impede productivity and undermine security. Self-Service SSO keeps manual tasks to a bare minimum.
* **Eliminating the need to share sensitive information:** Configuring SSO often requires the ISV and the business customer to share sensitive information (e.g., client IDs, SAML certificates, etc.), but Self-Service SSO eliminates these exchanges.

## How Self-Service SSO Works

Self-Service SSO requires minimal configuration in your Auth0 tenant and provides your customers with a setup assistant that guides them through the enablement process. After a customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

Diving a little more deeply, Self-Service SSO uses three components to delegate setup to your customers:

* **Self-Service profile:** Defines key elements of customer SSO implementations, such as the IdPs they can use for SSO and which user attributes they must capture (e.g., email address)
* **Self-Service access ticket:** Grants customer admins access to the SSO setup assistant and sets specific details for their resulting SSO integration
* **SSO setup assistant:** A Self-Service Wizard that guides customer admins through the SSO setup process — enabling your business customers’ administrators to create, edit, and test SSO connections

You also benefit from additional **observability** features, including new tenant logs to monitor ticket consumption and the creation and enablement of connections; you can monitor logs to promptly initiate any tasks once the connection has been created.

At a high level, the Self-Service SSO workflow includes the following tasks:

1. You (the Auth0 by Okta customer) create a self-service profile in your tenant using the Auth0 Dashboard or the Management API.
2. Next, you use the Management API to create a self-service access ticket that allows customer admins to configure SSO.
3. You retrieve the ticket URL from the asset created in Step 2 and send this link to your customer admin.
4. Your customer admin launches the SSO setup assistant and follows the steps provided to create an application with their identity provider.
5. After the customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

<include src="Vidyard" id="UPTUao1LfxdMLrnD38Gsxc" />

## Getting Started

As enterprises continue to adopt best-of-breed tools, IT and security leaders will increase their focus on access management strategies, like SSO, that can simultaneously support productivity and contribute to a strong security posture.

Whether you include SSO within your base product or offer it as a premium add-on, Self-Service SSO enhances your overall value proposition.

By empowering your customers to configure their own SSO integrations with your app, you can streamline your onboarding process and grant them more autonomy over their sign-on experience — while reducing the time and costs associated with managing SSO across your customer base.

**If you’d like to learn more about this new feature**, we invite you to peruse [the Self-Service Single Sign-On documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO).

**Want to launch a B2B SaaS application quickly?** Check out our reference application, [SaaStart,](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/), a complete, working example of how to implement SaaS Identity with Auth0, built with the most popular frameworks developers use today. You can gain hands-on experience on Self-Service SSO and other essential CIAM features and quickly deploy a sample Auth0 template directly within the SaaStart [repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter) or from [our new integration](https://vercel.com/integrations/auth0) in the Vercel marketplace.


Empower Your Enterprise Customers to Set up Their Own SSO Implementations

amanda-giannelli

Senior Software Engineer

Amanda Giannelli

Simplify logins, boost security, and enhance productivity with the power of Single Sign On!

## Introduction

Are you tired of juggling a bunch of usernames and passwords just to get your work done? You’re not alone. In today’s world, where we use so many different apps and services, keeping track of login details can feel like a full-time job. 

Enter Single Sign On (SSO), a simple yet powerful solution that lets you access all your apps with just one login. Let’s dive into what SSO is and why it’s such a game-changer for businesses.

## What is SSO?

You may have already used SSO without realizing it. Whenever you log into a website that leverages [identity providers](https://auth0.com/docs/authenticate/identity-providers) such as Google, Facebook, or Apple (to name a few), that is single sign-on in action.

SSO is a fancy term for a straightforward concept: log in once, and you’re good to go across all your apps. Whether it’s checking your email, collaborating on a project, or logging into your CRM with SSO, one login gets you everywhere you need to be. It’s like having an all-access pass to everything you need for work.

## How Does SSO Work? 

When SSO is enabled, and you attempt to authenticate to App A, you are sent to the authentication server to provide your credentials. Once authenticated, you are redirected back to App A and signed in. If you then access any other services (for example, another app) connected to the same auth server, you will be immediately authenticated into this application.

![SSO authentication and how it works](https://images.ctfassets.net/23aumh6u8s0i/1rHF8E9UCO7abbWzLRntV0/6856815f4ee9b078d83093d2a21a6bc7/typical-sso.png)

> Read more about [SSO authentication and how it works](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/). 

## Benefits of SSO

Now that you have a general understanding of what SSO is, let’s take a look at some of the benefits.

### Enhanced User Experience

Remembering a bunch of different passwords is a hassle. With SSO, you only need to remember one password. No more struggling to recall if your password for App A has a special character or if App B requires an uppercase letter. Log in once, and you’re in — it’s that simple.

#### Goodbye, Password Overload

Keeping track of passwords can feel overwhelming. While a password manager is an option, SSO puts an end to needing scores of passwords. By reducing the number of passwords you have to remember, it’s less likely you’ll get locked out or end up using the same password everywhere (which, let’s be honest, [isn’t very safe](https://www.security.org/resources/online-password-strategies/)).

#### Get to Work Faster

SSO saves you time. Instead of typing in different credentials every time you switch apps, SSO gives you instant access. It’s like walking through an open door instead of fumbling for keys — you get to work faster and with less hassle.

SSO providers also typically provide a dashboard with all of the apps you have access to. Open the dashboard, select your app, and you’re in. 

### Boost Security

You might think that having one login for everything sounds risky, but SSO actually makes your business more secure. Here’s how:

#### One Secure Login Point

With SSO, all your logins are managed in one place. This means your IT team can keep a close eye on things and quickly respond if something looks suspicious. It’s like having all your valuables in one safe instead of scattered around the house.

#### Reduced Chance of Phishing 

[Phishing scams](https://auth0.com/blog/protecting-against-phishing-attacks/) — fake emails trying to steal your info — are a big problem. But with SSO, you’re not entering your password over and over, so you’re less likely to fall for a phishing trap. Fewer logins mean fewer chances for scammers to trick you.

#### Add Extra Security with MFA

Most SSO solutions let you add [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication) (MFA), which provides another layer of security by requiring more than just a password to log in. Maybe you’ll need to enter a code sent to your phone or scan your fingerprint. This extra step makes it much harder for hackers to get in, even if they have your password.

### Lighten the Load on Your IT Team

SSO isn’t just great for users. It's also a lifesaver for your IT department. Managing user accounts and passwords can be a real headache, but SSO makes it a breeze.

#### Easier User Management

With SSO, your IT team can manage who has access to what from a single dashboard. Need to give new employees access to all the tools they need? Done in a few clicks. Need to remove access when someone leaves? Just as easy. It’s all centralized, which saves time and reduces errors.

#### Fewer Helpdesk Calls

Did you know that [up to 50% of helpdesk calls](https://agio.com/your-employees-are-wasting-30-of-their-time-resetting-passwords/) are for password resets? SSO cuts down on the need to [reset your password](https://auth0.com/learn/password-reset), freeing up your IT team to focus on bigger issues and your employees to work on what truly matters. Less time resetting passwords means more time to solve real problems.

#### Smooth Compliance and Reporting

If your business is in a regulated industry (such as finance or healthcare), SSO can make compliance a lot easier. It keeps detailed logs of who accessed what and when, so when it’s time for an audit, you’ve got everything you need at your fingertips.

### Scale Up with Ease

As your business grows, so do your tech needs. The good news? SSO grows with you. Whether you’re adding new apps or expanding your team, SSO makes it easy to scale up.

#### Integrates with What You Already Have

SSO solutions are designed to work with the tools you’re already using, whether they’re in the cloud, on your servers, or a mix of both. So, no need to overhaul your entire system — just plug SSO in and keep moving forward.

#### Works Across All Environments

Many businesses today use a mix of on-premises and cloud-based applications. SSO bridges the gap, providing a seamless login experience across all platforms. So, as you move more of your operations to the cloud, SSO keeps everything running smoothly.

#### Future-Proof Your Business

By implementing SSO, you’re setting your business up for success as you grow. No matter how many new apps or services you add, SSO will be there to keep everything secure and accessible, ensuring your team can stay productive without getting bogged down by tech hurdles.

### Better Collaboration with Partners

If your business works with external partners or clients, SSO can make those relationships smoother and more secure. Here’s how:

#### Secure Partner Access

SSO lets you extend secure access to your partners without compromising your internal security. You control who sees what, so everyone has the access they need — and nothing more.

#### Easier Collaboration

When your partners can log in easily without juggling multiple credentials, it’s easier to work together. Whether you’re sharing documents or managing a project, SSO makes collaboration a breeze.

### Challenges

For all of its amazing benefits, SSO is not without its challenges. Understanding these considerations can help you plan effectively and ensure that your SSO implementation is successful. Here are a few to keep in mind:

#### Single Point of Failure

SSO centralizes authentication, so if the SSO system goes down, users may lose access to all connected applications. This is why high availability coupled with redundancy for your SSO solution is critical to reduce downtime. High availability means the system is always on and available no matter what happens. Redundancy enables high availability by acting as a backup plan in the event of failure to ensure the services remain functional. 

#### Setup and Integration

Integrating SSO into existing applications can be complex and time consuming, especially when dealing with a mix of legacy and new systems. Careful planning and coordination between IT teams and application owners is crucial to ensure a smooth implementation.

#### Security Risks

While SSO can enhance security, it can pose a risk if not properly managed. If an attacker gains access to a user’s SSO credentials, they could potentially access multiple applications. Implementing strong authentication methods, such as MFA, is essential to mitigate this risk. 

#### User Adoption and Training

Users need to be educated on how SSO works and the importance of keeping their credentials secure. Without proper training, there may be confusion or resistance — especially in less tech-savvy organizations. 

## Conclusion

SSO isn’t just a buzzword. It’s a powerful tool that can make your business more efficient, secure, and scalable. By simplifying the login process, reducing security risks, and lightening the load on your IT team, SSO can help your business thrive in today’s fast-paced digital world.

If you’re not using SSO yet, now’s the perfect time to start. Whether you’re a small business looking to grow or an established company ready to streamline operations, SSO can give you the boost you need to stay ahead of the curve.

Benefits of Single Sign-On (SSO)

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

In this post you will learn about Single Sign-On (SSO) authentication and how to use it for your web apps

[Single Sign-On (SSO)](https://auth0.com/resources/whitepapers/definitive-guide-to-single-sign-on) authentication is now required more than ever. Nowadays, almost every website requires some form of authentication to access its features and content. With the number of websites and services rising, a centralized login system has become a necessity. In this post, we will study how **SSO authentication** is implemented for the web. Read on!

<AmpContent>
<amp-youtube
    data-videoid="Vp6kx4Sd_E0"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/Vp6kx4Sd_E0' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Federated Identity Glossary

The concept of a centralized or linked electronic identity is known as *federated identity*. Federated identity systems handle several concerns:

- Authentication
- Authorization
- User attributes exchange
- User management

The **authentication** aspect deals with validating user credentials and establishing the identity of the user.

**Authorization** is related to access restrictions (e.g., is the user allowed to access X resource?). 

The **attributes exchange** aspect deals with data sharing across different user management systems. For instance, fields such as *"real name"* may be present in multiple systems. A federated identity system prevents data duplication by linking the related attributes. 

Lastly, **user management** is related to the administration (creation, deletion, update) of user accounts. A federated identity system usually provides the means for administrators (or users) to handle accounts across domains or subsystems.

SSO is strictly related to the **authentication** part of a federated identity system. Its only concern is establishing the identity of the user and then sharing that information with each subsystem that requires the data. Below, we focus on this crucial aspect of a federated identity system.

![What is single sign-on separator 1](https://images.ctfassets.net/23aumh6u8s0i/2xIzg7UIbBpGNvCeRsdn4k/32f29b73fc2b4bd33bac6fe124d9bfb1/what-is-sso-1)

## Single Sign-On (SSO) Authentication

Sooner or later web development teams face one problem: you have developed an application at domain X and now you want your new deployment at domain Y to use the same login information as the other domain. In fact, you want more: you want users who are **already logged-in** at domain X to be already logged-in at domain Y. This is what SSO is all about.

![Non-Single-Sign-On Scenario](https://images.ctfassets.net/23aumh6u8s0i/4pa532TumNn6TI3gQmMWEw/0a6182b447b75b24bea1b763c1ba73a1/non-sso-scenario)

The obvious solution to this problem is to **share session information** across different domains. However, for security reasons, browsers enforce a policy known as the [*same origin policy*](https://en.wikipedia.org/wiki/Same-origin_policy). This policy dictates that cookies (and other locally stored data) can **only be accessed by its creator** (i.e. the domain that originally requested the data to be stored). In other words, domain X cannot access cookies from domain Y or vice versa. This is what SSO solutions solve in one way or the other: sharing session information across different domains.

![No cookie sharing](https://images.ctfassets.net/23aumh6u8s0i/2WJQLWBpByFyth3ufF3Af0/5f341d8816d77f20dc05c5a2f31ec89f/same-origin-policy-forbids-this)

Different SSO protocols share session information in different ways, but the essential concept is the same: there is a **central domain**, through which authentication is performed, and then the **session is shared** with other domains in some way. 

For instance, the central domain may generate a signed [JSON Web Token (JWT)](https://auth0.com/docs/jwt), which may be encrypted using [JSON Web Encryption (JWE)](https://tools.ietf.org/html/rfc7516). This token may then be passed to the client and used by the authentication domain as well as any other domains. The token can be passed to the original domain by a redirect and it contains all the information needed to identify the user for the domain requiring authentication. As the token is signed, it cannot be modified in any way by the client.

![SSO - Central authentication domain](https://images.ctfassets.net/23aumh6u8s0i/2GrAhJRypY1XQx3TIDbqzO/ecbd47c21f1e1c1fd334a239b9015a08/using-central-auth-domain)

Whenever users go to a domain that requires authentication, they are **redirected** to the authentication domain. As users are **already logged-in** at that domain, they can be immediately redirected to the original domain with the necessary authentication token.

![Single Sign-On Authentication](https://images.ctfassets.net/23aumh6u8s0i/4hakDPwQtaPfcDNwkd4C9x/e54ee76304953540b4b71fcccbaf690a/typical-sso-v2)


## SSO Authentication with Auth0

If you have been reading about SSO online, you have probably found that there are many different implementations: OpenID Connect, Facebook Connect, SAML, Microsoft Account (formerly known as Passport), etc. Our advice is to choose whatever is simplest for your development efforts. For instance, [SAML](https://auth0.com/docs/protocols/saml) is deeply entrenched in enterprise developments, so in some cases, it will make sense to pick that. If you think you will need to integrate your development with more than one alternative, don't despair: there are frameworks that allow interoperability between different SSO solutions. In fact, that's one of the things we do at Auth0.

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

You can go and check our [docs on Single Sign-On](https://auth0.com/docs/sso/single-sign-on) and the [Auth0 SSO samples](https://github.com/auth0/auth0-sso-sample).

If you remember the Typical SSO Scenario diagram we saw earlier, you can see how Auth0 comes to play in the next diagram:

![SSO with Auth0](https://images.ctfassets.net/23aumh6u8s0i/5n5APnJDhCtUiyZvyAG6rK/5a9faf400e436dd131bdee21b81c8761/auth0)

In this case, **Auth0 is the [Authentication Server](https://auth0.com/blog/what-is-an-authentication-server/)** and it works as a *bridge* between different SSO frameworks. 

<include src="ebook-ads/SsoGuide" />

## Conclusion

Single Sign-On authentication is here to stay. Decentralized systems are becoming more and more common and authentication is an essential aspect of all of them. SSO solves a big problem: how to manage the increasing number of users across a whole ecosystem of applications and services. Frameworks such as [OpenID Connect](https://auth0.com/resources/ebooks/the-openid-connect-handbook?ref=blog) and services such as the one we provide at Auth0 make [integrating Single Sign-On](https://auth0.com/learn/how-to-implement-single-sign-on/) into your new or existing applications much easier. If you are implementing authentication for a new application or service, consider integrating SSO from the get-go.

![What is single sign-on separator 3](https://images.ctfassets.net/23aumh6u8s0i/5L0CZk6C2On5CTXSHlE3MF/50e145cd648e88dd800f90ca19cfa1e4/what-is-sso-3)

What Is Single Sign-On Authentication (SSO) And How Does It Work?

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

With an identity clearinghouse, you can stay focused on your business, not figuring out who your users are.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>


## What Is Federated Identity Management?

In the early days of the web, your digital identities were dispersed across all the different sites and applications that you used:

* Each time you went to a new site, you made up a username and password.
* They were then stored on that site.
* Every time you returned, you had to re-enter your credentials, and so on and so forth for each site you visited.

This was an unwieldy system. Users would never stay logged in across sites, even when those sites were managed by the same organization. It was like an amusement park where you had to identify yourself as a paying visitor at each ride.

![Non Single Sign On scenario](https://images.ctfassets.net/23aumh6u8s0i/3pAEBDQyBT2dAsPrW5xepc/0a232360554394e039154ff96d1855b3/non-sso-scenario)

The problem was that if an organization wanted to have user credentials carry over from one domain to another, then there would have to be a new system for authentication. As the internet grew more complex and more interconnected, developers started to realize that siloing authentication on individual domains was not a scalable system.

## How Federated Identity Management Works

[The web's early infrastructure was not built to permit federated identity management](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/)—it worked against it. In fact, it was one of the earliest and most crucial principles, the same origin policy, that made the idea very difficult to implement:

* The same origin policy states that no cookies or other information stored on an end-user's computer can be accessed except by the original *creator *of that information.
* This is fundamental—it means that domain Y can't rifle through your data and find your username and password to domain X. Without this policy, the whole idea of internet security would be moot.
* What this meant was that companies with multiple domains, if they wanted users to have a seamless, fluid experience navigating between them, had to find another way to securely transfer information.

![Same Origin Policy Forbid this](https://images.ctfassets.net/23aumh6u8s0i/Y4uwUUFRMNldhozrmwmBI/38d2f66d0e665259c3019bf48c38df01/same-origin-policy-forbids-this)

All federated identity management systems are, in some way, methods of transferring data without violating the same origin policy. Here's how it generally works:

* You (the user) try to log into the client (an app)
* A request for authentication is sent from the client to an authorization server
* Authentication is returned from the authorization server to the client
* You (the user) are permitted to access the client (or not)

This way, if domain X and Y are related, and their owners want users to move freely between the two, they can simply triangulate around an external authorization server. This benefits overall security (by exposing the client to less overall log-in attempts, and therefore less risk) but the clearest result is a unified, smooth user experience.

## The Single Sign On Era

Today, we see federated identity everywhere, most noticeably in what we call “single sign on.” With single sign on, you can log into your GMail and then open up YouTube in a different tab, for instance, and you'll stay logged in. It all hinges on a central domain verifying the status of each user as they move across sub-domains:

* You log in once
* Authentication is done through a central domain
* A token or cookie is generated to authenticate you across other domains

![Typical Single Sign On](https://images.ctfassets.net/23aumh6u8s0i/4hakDPwQtaPfcDNwkd4C9x/e54ee76304953540b4b71fcccbaf690a/typical-sso-v2)

[Dozens upon dozens](https://auth0.com/docs/identityproviders#enterprise) of different SSO identity providers have cropped up to provide this kind of service to webmasters, each with its unique requirements, uses, strengths and weaknesses:

* SAML
* OpenID Connect
* Facebook Connect
* Microsoft Active Directory
* Twitter

Some are more enterprise-focused, while some authenticate through social media and are better for personal use. Some use a decentralized system—with SAML, for instance, any node in the SAML network is capable of accepting the authentication done by another node. Some don't—when you log in through Facebook Connect, all authentication is done by Facebook.

Emerging in popularity now are passwordless systems, where your access does not hinge upon a set of credentials but your possession of some other factor, like your cell phone or unique fingerprint:

![Passwordless Connections](https://images.ctfassets.net/23aumh6u8s0i/To08k5ZER7MI9Iv5VcODK/1a512270d5e87fce8ccd47043c412529/passwordless-connections)

When you're choosing an identity provider and means of authentication, you need to take into account each provider's limitations and benefits and choose the one that's best for your users and your needs.

[Learn how to evaluate a modern identity management solution that fits your needs in this free eBook, Build vs Buy: Guide to Evaluating IAM.](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/)

## The Problem With Decentralization

Of course, the profusion of different SSO services presents a dilemma. If you're running a site, you usually choose one. That means other authentication services won't work. And the problem just gets worse the bigger your organization gets. Today, you might have:

* A dozen internal tools and third-party tools rotating in and out of use just at your own company.
* Each tool is built on a different stack and speaks to the others with a different protocol.
* Customers with tens of thousands of employees, each with their own arsenal of third-party tools.

In the old days, all corporate software was stored on massive internal server racks. There was no need to worry about integration because everything you needed was stored in one place—everything was already integrated. Now there are endless different social and enterprise options just for logging into an app:

![Social Providers](https://images.ctfassets.net/23aumh6u8s0i/13Ied0gAWBe6wLbuCrXP6R/b82464213f04accf721fcd0422e7bff5/social-providers)

![Enterprise Providers](https://images.ctfassets.net/23aumh6u8s0i/4fvVxxcQm5nkKxe9GzfgaY/6c0a42804631b8de96c08a56e67a3145/enterprise-options)

Now, providing that kind of integrated experience means negotiating between all the different identity providers that your users authenticate with, but it also means dealing with different:

* **Authorization practices:** delineating specific access restrictions, i.e. “Can user X access Y section of the site?” and keeping those consistent.
* **Attributes exchange practices**: avoiding the duplication of user data created by the interactions between different identity providers.
* **User management practices**: being able to access, create, update, and delete user accounts.

All SSO can do is authorize different kinds of people when they come to use a service—it's just one aspect of a federated identity management system.

## Auth0 and Federated Identity Management  

Auth0 is both a classic identity provider and a federated identity management system. This means that you can set it up so that:

* Users see an Auth0 log-in box when they visit your site
* When they sign up, their credentials are stored with Auth0
* When they log in, their credentials are authenticated with Auth0

<include src="TweetQuote" quoteText="Auth0 is both a classic identity provider and a federated identity management system."/>

![Auth0's solution](https://images.ctfassets.net/23aumh6u8s0i/7yX585bQJMurpZkF2cg1Oq/a56b325dc9ce56f4dc5a5847eaf92622/auth0)

With this arrangement, Auth0 behaves as a normal single sign on app. You can then go to any other app or site that uses Auth0 and you will remain logged in if an administrator has enabled that option.

But with just a few lines of code, you can also

* Integrate with virtually any protocol you want to make available to your users: SAML, OpenID Connect, Facebook Connect, Microsoft Active Directory, Twitter, and more.
* Manage user accounts and check out your identity-based analytics right in the Auth0 dashboard.
* Leverage your users' social data to provide a personalized onboarding experience

Auth0 is a true federated identity manager in the sense that it doesn't *just *allow for you to stay signed in across domains. Auth0 also gives you access to the user accounts of everyone on your system, allows you to set specific access restrictions across identity providers, and keep all of this data consistent.

Auth0 can be a clearinghouse for the identities of all your users whether you're running a consumer-facing mobile app or an enterprise system with a SAML-based identity provider. One click is all it takes to turn integrations on and off, and to secure them with Auth0's [full lineup of security features](https://auth0.com/security).

[Learn how to evaluate a modern identity management solution that fits your needs in this free eBook, Build vs Buy: Guide to Evaluating IAM.](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/)


Why Federated Identity Management Matters

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How Single Sign-on (SSO) streamlines authentication and what makes for a good SSO solution.



Everyone who uses the internet agrees that life would be better with fewer logins. For users, logging in is a hassle that interrupts whatever they were trying to do and forces them to remember their password. What's bad for user experience is doubly bad for businesses, because a frustrated user is more likely to walk away from a transaction or browse a website without logging in.

The solution for a world with fewer logins is single sign-on (SSO), which allows a user to log in once and automatically gain access to a suite of connected applications. Companies that implement single sign-on properly benefit from improved user experience and heightened security. Below, we'll explain how single sign-on works and the differences between a good SSO policy and a bad one.

## What Is Single Sign-On?

Single sign-on is a method of logging in that lets a user enter in their login credentials (usually a username and password) just once and automatically be logged into multiple websites or applications. Single sign-on is one element of identity and access management (IAM), which is the entire set of tools and protocols governing how users log in and gain access to data.

An SSO solution is like a library card. A library card lets you check out books from every branch in a library system instead of having to get a separate card and a separate account for each one. This makes life easier for patrons, who can now access books from all of the local branches instead of just one. And it makes things easier for the organization because they know how people are using their services (and who owes late fees). SSO operates according to the same principle, except instead of uniting the different library branches in a city, it unites different digital properties used by a single company.

![Single Sign-On](https://images.ctfassets.net/23aumh6u8s0i/K75jZ7ram6DqcgeRpdk5E/b63faf3f58df73ff601059244656a438/single-sign-on-info)

The most widely known customer-facing example of single sign-on is Google's G Suite. Users log in to their Gmail accounts, and when they navigate to Google Docs or YouTube, they're automatically logged in. While end-user authentication is the most widely known use case for SSO, its also used in business-to-employee (B2E) settings.

Some companies also use SSO for their employees, so a single set of credentials grants access to a set of applications. For instance, if an employee logs into their employee portal, they'll be immediately logged into Slack and Zoom with their employee ID.

SSO is a part of the broader concept of [federated identity management](https://auth0.com/blog/why-identity-federation-matters/), which allows for someone to use a single identity across multiple different systems. SSO refers specifically to a single login giving a user access to multiple properties that are still part of a single organization.

Federated identity, meanwhile, means using the same identity to log in to properties owned by multiple organizations. It's possible to have a federated identity that isn't a single sign-on. For instance, an app could enable social login (logging in with something like Facebook, Google, or Apple ID) but still only use that login for a single property.

## How Does Single Sign-on Work?

On a technical level, SSO works by having users give their credentials to the SSO solution instead of logging in directly to a website or app. The SSO solution, in turn, checks these user credentials with the company's authentication server (a database of credentials) or identity provider.

An identity provider is a service that stores and manages user identities on behalf of an application. For end users, common identity providers include Google and Facebook. [Enterprise identity providers](https://auth0.com/docs/connections/identity-providers-enterprise) include Microsoft Active Directory, Azure AD, LDAP, and G Suite. Users can log in using an account they've already created with a separate identity provider, which saves them from filling out a new registration form. Using an outside identity provider saves businesses from having to store this information themselves on an authentication server. That's a security advantage for businesses because having databases full of passwords can make them targets for hackers.

When the SSO solution confirms that a user is logging in with the correct credentials, it issues them a token. Then, when they go to a new page, the token confirms that they're already logged in and don't need to do so again. There are multiple ways this interaction can take place using Security Assertion Markup Language (SAML) or Open Authorization (OAuth). For our non-developer purposes, the primary difference between these two is that SAML is used to verify a user's identity (authentication), whereas OAuth controls what resources users are allowed to access (authorization).

Most SSO solutions also include single log-out (SLO), which means that logging out of one site automatically logs you out of the rest.

## Single Sign-on Challenges and Benefits

The right SSO solution can create more streamlined user experiences, improve analytics, and increase security. Despite this, SSO adoption has been relatively low, even among businesses that use other cloud-based identity solutions. According to a [2019 Bitglass report](https://www.businesswire.com/news/home/20191105005310/en/Bitglass-2019-Cloud-Adoption-Report-Enterprise-Cloud), 86% of companies currently use cloud applications, but only 34% use single sign-on (SSO).

This slow adoption rate is due to security concerns and the technical challenges of implementing SSO in-house. Each of these issues deserves attention, but there are solutions for each.

### SSO security risks and solutions

With SSO, a user's login credentials act like a skeleton key that unlocks multiple applications. Unfortunately, the more doors a password opens, the more damage a hacker can do with it. That danger is greater for users who reuse their passwords. One of the biggest cybersecurity risks in recent years is [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/), in which hackers use credentials stolen in one data breach to hack into other sites. It's an effective tactic, precisely because many people use the same passwords for everything.

On the other hand, SSO can actually reduce the chance of compromised credentials because it reduces "password fatigue." The fewer passwords people have to create, the less likely they are to reuse old ones.

Still, the best way to ensure that SSO doesn't hurt security is to combine it with strong authentication protocols like [multifactor authentication (MFA)](https://auth0.com/learn/multifactor-authentication-customers/). MFA, also known as two-factor authentication (2FA), asks users to give additional credentials that prove who they are in the event of a suspicious login or which engaging in risky behaviors (such as accessing payment information).

Companies don't want to use MFA for every login: doing so will create too much friction for customers, so they need a customizable approach. Contextual MFA lets companies determine the situations in which to ask for more credentials. For instance, if a user is logging in on a new device, an MFA solution may ask them to confirm their identity. That may mean sending a verification code to their phone or email or using biometrics, such as a fingerprint.

![MFA](https://images.ctfassets.net/23aumh6u8s0i/iicHPmWM3HmnyEc2MPHBJ/3844cce0e03ebe9cd30b2f095f06d11a/manage-mfa-ss-43963efc4c)

The other critical element in keeping SSO safe is controlling session length (how long users stay logged in) based on risk. For example, a banking app might automatically log out users after a few minutes of inactivity. A video-streaming site, on the other hand, doesn't need to be so strict about access control and can allow for sessions that last for weeks before they ask users to verify their identities again.

### SSO implementation challenges and solutions

When companies try to design their own SSO solutions in-house, they run into some common and potentially expensive problems. For one thing, integrating identity across different types of directories is a challenge, especially for companies using legacy applications. Getting these applications to communicate is akin to trying to connect LEGO blocks with Lincoln Logs. Likewise, it's challenging to design an SSO solution that's compatible with different devices and operating systems, such as Android and IoS products.

Then there's the issue of user migration. Let's return to our library analogy and imagine that, until recently, all the local libraries kept their own databases of users, and now they're trying to combine them. This creates problems because some people have accounts at every branch and possibly have different information on file with each one. Migrating all that data into a single source of truth and correcting it as you go can be a huge headache.

That's why it's simpler and often more cost-effective for companies to use a third-party SSO solution instead of building one from scratch. With an outside SSO provider, integrations have already been solved, migration is simplified, and SSO can simply be plugged in and switched on.

![SSO Solution](https://images.ctfassets.net/23aumh6u8s0i/6MDhnlpJSVSBaFHs7Cpb2J/40794b467fc8ce1c707dd241497587f4/sso-integrations)

While some companies offer SSO as a stand-alone solution, it's usually part of a suite of services offered by an identity-as-a-service (IdaaS) company. The advantage of using an IDaaS provider for IAM is that it includes the tools you need to use SSO safely, like customizable MFA. Whether you're looking to implement SSO for your end users or your employees, the right IAM solution is the one that includes the integrations and customizability you need.

## The Right SSO Solution Helps Everybody

When an SSO solution has the right security safeguards, it can streamline the authentication process and lead to fewer headaches for all parties. People aren't overwhelmed by a ballooning number of user accounts, and businesses get fewer help-desk calls for lost passwords. It all depends on finding an SSO provider that handles a user's identity securely and efficiently.

<include src="asides/AboutAuth0" />


What Is Single Sign-On (A Non-developer's Guide)

Why more companies are entrusting identity to the experts in the name of security and growth


Every organization that uses a login box must have some form of identity and access management (IAM) system to keep track of users and control access to data and services. But in recent years, managing identity has become more complex. Today, identity management is inextricably bound to issues of security, user experience (UX), and scalability.

To cope with the challenge of maintaining IAM systems, more and more organizations are turning to Identity-as-a-Service (IDaaS) providers.

But what exactly is Identity-as-a-Service? What do these providers offer that can help businesses navigate such a challenging environment?

In this piece, we’ll define identity as a service &mdash; its core components and the reasons why it’s a rapidly growing segment of Software-as-a-Service (SaaS).

## IDaaS Defined

When an organization creates or updates an application, they have to choose which functionalities to write themselves and which to entrust to a third party. For instance, if you’re writing an application that takes payments, it’s often more time- and cost-effective to use a platform like Square rather than making your own payment system from scratch. 

The same holds true if your application requires users to log in. Given the complexities of logins and the many ways that identity management touches on analytics and security, it’s often simplest to purchase an IDaaS solution that integrates into your software and handles these issues for you.

IDaaS providers offer cloud-based solutions for IAM functions. 

When you purchase an IDaaS service, you’re essentially purchasing an API (Application Programming Interface). In the simplest terms, an API is a set of programmed rules for how software components or applications interact, like a translator or mediator. 

In the case of IDaaS, the API mediates the authentication flow between the end-user and the customer’s application(s). IDaaS may also be used to mediate Authorization to certain areas of the application or to access certain data within the application(s) your company is building.  

When we talk about managing identity, we’re referring to the identities of three basic classes of users:

* Customer identity and access management (CIAM), which applies to end-users.
* Workforce IAM, which manages your staff and their access to internal applications.
* B2B IAM, which lets businesses integrate identity with their business partners and enterprise customers.

Each of these classes requires a different approach, and an organization may subscribe to an IDaaS provider for all of them or just one.

There are a few core features common to virtually all IDaaS providers. These include:

* Multi-factor authentication (MFA)
* Biometrics
* Single Sign-On (SSO)
* User management and access control

We’ll get deeper into all those terms below.

### Multi-Factor Authentication (MFA)

[MFA](https://auth0.com/docs/mfa) is an increasingly popular way of verifying a user’s identity. It’s more secure than the traditional username/password method of logging in since [passwords are vulnerable to multiple types of attacks](https://auth0.com/blog/what-is-broken-authentication/#:~:text=Auth0%20Docs&text=Broadly%2C%20broken%20authentication%20refers%20to,to%20masquerade%20as%20a%20user.).

MFA requires users to log in with more than one piece of identifying information (i.e., a push notification in addition to a password).

Users must share some combination of the following credentials to log in:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a cell phone)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The most common form of MFA is two-factor authentication (2FA), though you may customize an MFA solution to ask for more credentials depending on the security risk.

Despite numerous reports on [the benefits of multi-factor authentication for stopping data breaches](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), widespread adoption is still surprisingly low &mdash; though it has increased significantly in recent years:

![2fa-blog](https://images.ctfassets.net/23aumh6u8s0i/3UNdOb3k1qtTTy3vXU2NhJ/ca5386396ac47062473b3562d3314c9f/2fa-blog)

One of the reasons for the lagging adoption rate is that designers are wary of creating extra friction at login, especially for B2C authentication. But third-party IDaaS providers offer more customizable MFA options, like [step-up or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/). These approaches to MFA only ask for extra credentials if a user meets a certain risk profile; for instance, logging in from a new IP address or changing payment information.

### Biometrics

Biometrics means the use of an “inheritance” criteria &mdash; something the user is as a means of verification. If you’ve ever unlocked your smartphone with your thumbprint, you’re familiar with biometrics.

![biometrics](https://images.ctfassets.net/23aumh6u8s0i/4H45r7da3K3WplJ96rXE8B/ea359f09fc4bd01419eebdc67f09f29d/biometrics)

In addition to thumbprints, other biometric authentication methods include iris or retina recognition, full [facial recognition](https://www.syte.ai/blog/brief-history-image-search/), fingerprint, hand, and DNA usage.

Many organizations are excited to use this technology and have turned to IDaaS providers to implement it rather than trying to train their in-house teams on this specialized branch of knowledge.

### Single Sign-On (SSO)

[Single Sign-On (SSO)](https://auth0.com/single-sign-on) allows users to log in to one application and then automatically be logged in to other designated applications. Most people are familiar with SSO through Google, since signing in to one Google property such as YouTube grants you access to Gmail and other applications. SSO is popular for companies with multiple brands since it allows for greater user visibility, as well as reduced friction. There are also use cases for SSO in workforce and B2B identity management.

![Single Sign-On (SSO) in action](https://images.ctfassets.net/23aumh6u8s0i/6t0LdnTcofxK6ekdSpDEja/a7376b8f04ca074a0d88dd1470d3be55/sso-desktop.jpeg)

### User management and access control

One essential element to any IAM system is the ability to control who is permitted to access data by provisioning users with different roles. IDaaS systems simplify this process by centralizing identity and putting these controls into a single location like a user dashboard. That’s a significant advantage in making sure sensitive data stays in the right hands since it’s much less prone to error than an IT team manually controlling access to individual applications.

## Why Enterprises Choose IDaaS

IDaaS is undergoing a period of exponential growth as more companies—from startups to multinational corporations—decide to outsource identity. The IDaaS market is [predicted to grow](https://www.marketsandmarkets.com/Market-Reports/identity-as-a-service-market-32235637.html) from $2.5 billion in 2019 to $6.5 billion in 2024.

Why this shift toward third-party identity solutions? The reasons include the need to meet legal requirements, manage security risks, and implement an identity solution designed around scalability and extensibility.

### Data privacy law compliance

One of the reasons that IDaaS has become so important recently is the rush to comply with new data privacy regulations. These include the [EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA)](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), and others.

Organizations that fail to comply with these regulations can face stiff penalties. For instance, under GDPR, organizations without secure and transparent data practices can be fined up to 20 million euros or 4% of annual global turnover &mdash; whichever is higher.

![GDPR compliance checklist](https://images.ctfassets.net/23aumh6u8s0i/4XXboWYzyp7LPl5BulfQsM/4a439e75374582bfe2a5cea60fb02120/gdpr-compliance-checklist)

Data privacy laws often grant users more rights over their data. These rights vary depending on the law, but they may include:

* A new right to data portability
* An extended right to be forgotten (also called the right to erasure)
* The right to opt in or out of data collection and sales

These rights translate to a new set of obligations for organizations. It’s now essential to have a centralized repository of user data to satisfy reporting requirements and protect sensitive data according to current best practices. Data privacy laws are rapidly evolving, and managing compliance can be a full-time job, especially for organizations with uses in multiple jurisdictions.

Managing compliance is a major undertaking for any company. However, relying on an IDaaS partner can keep track of even siloed identity stores. A centralized identity solution can deliver lower maintenance costs and greater peace of mind. Although an IDaaS provider can’t ensure your organization will be fully compliant, IDaaS tools can certainly help.

### Increased security With IDaaS

In recent years, identity has become a major source of [high-profile hacks and data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/). In fact, Verizon’s [2020 data breach report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf) found that over 80% of breaches from hacking involved brute force attacks or the use of lost or stolen credentials.

The best protection against [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) are the features IDaaS providers specialize in: MFA, brute force and anomaly detection, and rigorous access control.

### Extensibility, adaptability, scalability

Legal and security concerns are the most frequently mentioned benefits of partnering with an IDaaS provider, but a sophisticated approach to identity can also help growing companies boost their bottom lines. Organizations with custom-built IAM solutions frequently find that maintaining these systems and adapting them to new needs and partners takes months of developer time.

For instance, in 2019, Apple mandated that [every app on the App Store had to include “Sign in with Apple” as a login option](https://developer.apple.com/news/?id=09122019b). Companies with bespoke IAM systems scrambled to meet this requirement, and many found that their systems were rigid and full of legacy code. Most IDaaS providers, on the other hand, included this as a simple update.

Having an extensible identity platform is also essential to integrating users during [Merger and Acquisition (M&A) deals](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/) and in deals between enterprises. Two organizations with IAM systems that can’t talk to one another can’t benefit from each other’s data, but an IDaaS provider can act as a translator between different back ends.

## What’s Ahead For IDaaS

IDaaS is an increasingly important segment of SaaS, propelled by new regulations, heightened security risks, and excitement about new technology.

Even organizations that typically adopt a "Do it yourself" (DIY) attitude about building their own features are beginning to recognize the value of relying on third-party identity providers. They can make that switch at any stage: during initial product development, prior to release, or at an inflection point at which they see the limits of their in-house IAM system.

The definition of IDaaS will continue to evolve as providers add new features, but the need for specialized expertise to handle these matters will remain constant.

<include src="asides/AboutAuth0" />


What Is IDaaS?

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Deploy SSO and MFA to tackle the challenges being faced by millions of remote employees


  <div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Make remote work safer and easier today — <a href="https://auth0.com/pricing/">click here</a> to get started.</strong></div>


As many organizations are discovering, remote working does not just mean providing employees with a laptop and expecting business to continue as usual. Instead, organizations are being confronted with new challenges - everything from Zoom etiquette (yes, your colleagues can tell you are reading Twitter) to their employees doubling as stand-in math teachers.  

An important challenge facing organizations now is authentication and authorization. Auth0 knows what it’s like to support a handful, all the way to hundreds, of remote workers. Having the capability and tools to verify that only the right employees are logging on is essential for improving everything from productivity to security. 

![Auth0 offers free workforce authentication](https://images.ctfassets.net/23aumh6u8s0i/1XCJWYdlEpVtx6HwzMCVtb/0374d37fe78ead6932a9d418aad0d3fa/value-transparency)

In addition to the recently announced [free tools for startups battling COVID-19](https://auth0.com/blog/auth0-startup-relief-helping-innovators-battle-covid-19/), Auth0 is doing more to help organizations reduce the stress of authentication and authorization of remote workers by offering internal employee authentication **free until August 31st** (up to 500 users).

As long as your admin email domain is the same as your employee domain, you can set up secure, remote logins for your employees and organization. We’ve got a simple and extensible ID Platform that can be adopted easily [in hours, not weeks](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider), making it suitable for _your_ workforce and _its_ requirements. As part of this free offer, businesses can take advantage of the following features:

* [Single Sign-On](https://auth0.com/single-sign-on) for ease and productivity
* [Multi-factor authentication](https://auth0.com/multifactor-authentication) for peace of mind
* [Connection to most identity providers](https://auth0.com/docs/connections/identity-providers-enterprise) for flexibility
<br>
<br>
<span style="color:#EB5424;"><a href="https://auth0.com/pricing/">Find out more here about how to get started today</a></span>

<include src="asides/AboutAuth0" />


Auth0 Makes Workforce Authentication Free Through August 2020

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

Tired of identity and authentication issues eating up your time and budget? There’s a simpler solution.



In any multi-brand company, enterprise architects (EAs) function like orchestra conductors overseeing the performance of each individual player, and simultaneously ensuring that every section is working together to play a unified symphony Yet these goals are particularly challenging for EAs in multi-brand media companies, where immense pressure exists to integrate and innovate across channels — and existing technology often isn’t flexible or powerful enough to meet these demands. In particular, one of the most common bottlenecks that EAs face is also one of the most critical for customer engagement: logging in.

Authentication and identity management at this stage can quickly become pain points for multi-brand companies, where maintenance dollars skyrocket, developer time is wasted, and opportunities for innovation and synergy across brands are lost.

Attempts to upgrade in-house processes, tailored to a patchwork of legacy systems, often unearth more (and more expensive) issues. However, by taking a more holistic approach, EAs have the option to create an identity management system that facilitates, rather than stymies, innovation and integration.

## Maintain a Single User Identity across Brands

Many multi-brand media companies covet a login that links users across brands and facilitates the creation of a unified user profile, since it has the potential to be both a money-saver and a money-maker. Implementing [Single Sign-On Authentication (SSO)](https://auth0.com/learn/how-to-implement-single-sign-on/) can support this.

With SSO, a user only needs to log in once to an application, and avoid having to enter their credentials again when switching to another brand, platform, or device. By implementing SSO across their network of brands, Finland's [Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) achieved major cost savings and “reduced friction across their brand portfolio.”

![How Single Sign on works](https://images.ctfassets.net/23aumh6u8s0i/2KZu1xqmgHXSNnmVTo2rrv/adb3004b36a04aff84af0c93645aca4c/how-it-work-flow)

Unfortunately, coding SSO in-house is often a cumbersome process. If you’re working with an array of outdated, fragmented systems, it can take an enormous amount of time and effort to customize SSO across your stack. Auth0’s platform helps eliminate those headaches and allows EAs to turn on SSO in any application with the flip of a single switch.

![Enabling Single Sign On in your custom app](https://images.ctfassets.net/23aumh6u8s0i/1ickLlLsRsT5uZCmO5mF0D/3c958bd8d5a172e42f60099fda74f088/enabling-sso-in-your-custom-app-flow)

Of course, simplicity on its own isn’t enough, and any SSO solution for a multi-brand enterprise needs to be extensible. With that in mind, Auth0 makes it easy for your in-house developers to write [Rules](https://auth0.com/docs/rules) that tailor authentication to your needs. So, for example, a media company could utilize [multiple types of paywalls](https://auth0.com/blog/the-role-of-ciam-in-implementing-a-sound-paywall-strategy/) across brands without forcing users to log in multiple times. In addition to offering customers a simple way of navigating through their favorite content, Auth0’s SSO solution cuts maintenance costs by simplifying app integration and administration.

## Keep Ahead of Ever-Evolving Identity

Just as multi-brand media companies are constantly evolving to embrace new technologies, partners, and business units, as [Auth0 Principal Architect Vittorio Bertocci](https://www.youtube.com/watch?v=Ug6D6Lwoh80&feature=youtu.be) shares in this brief video, best practices for identity management are in a constant state of change (and can be a “wild ride”. It’s a full-time job just to keep an identity management system equipped with the tools needed to stay ahead of hackers, interface smoothly with third parties, and provide customers with the identity control they expect. 

As Luis Salazar, co-founder of [Giving Compass](https://auth0.com/learn/giving-compass-case-study/) attests: “If we needed to code [identity] ourselves, we'd be at the mercy of continuous maintenance, because as the social plugins change their APIs, we need to revise our code."

Overhauling your identity management system with Auth0 frees you from the work of continuous patching. The universality of Auth0’s platform connects to any application, written in any language. Offloading authentication integrations to Auth0 means that you don’t have to worry about maintaining them in-house. This can translate to enormous financial savings by allowing your developers to work on their core product, and eliminating the need to hire more talent just for authentication and identity.

According to Mike Rogers, CTO and co-founder of [SiteMinder](https://auth0.com/blog/the-real-roi-of-auth0-part-4-maintenance/):

“Doing what Auth0 does in-house would cost hundreds of thousands of dollars each year, and that's just to manage the service and keep it running. To roll out additional features, that cost would rise directly in proportion to the number of features we would want to add and how many developers we would need to make it happen. Anytime Auth0 releases a feature, that's something we don't have to do ourselves.”

The savings offered by Auth0 aren’t merely anecdotal; a 2017 [Forrester report](https://auth0.com/forrester-total-economic-impact/) estimates that customers enjoy a minimum of “20% reduction in administration time and effort due to Auth0.”

## Outsource Your Regulatory Compliance

Identity management tends to be such a headache for EAs because the cost of getting it wrong is so high. A data breach can irrevocably tarnish a company’s image, and a slew of new international regulations threatens steep fines for companies that fail to comply. EAs in media have to be particularly mindful of compliance, as they often handle customers and content that span multiple nations, states, and sets of laws.

Increasingly, third-party security accreditations are the gold standard by which to judge whether an organization is handling data responsibly and legally. “Most Fortune 500 companies won’t sign deals if you don’t have the applicable certifications,” explains [Adam Nunn, Auth0’s Senior Manager of Governance Risk and Compliance](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/). However, earning and maintaining these certifications is expensive and labor-intensive. Annual costs to maintain certifications such as [SOC 2, HIPAA, and ISO27001](https://auth0.com/security/) can range from tens of thousands to millions of dollars.

By outsourcing accreditation to a trusted third-party such as Auth0, EAs can garner huge savings, not to mention peace of mind.

![Auth0 Certifications](https://images.ctfassets.net/23aumh6u8s0i/6Ke8qdEGmRoC4eG3PVwTac/ee2622de017bb88106852e5ee11205e5/auth0-certifications)

Auth0’s accreditations require annual re-certification to maintain, and we pass that investment on to our customers. “We're getting at least 50% ROI on the investment just for security alone," says [Sung Ho Choi, Co-Founder, fuboTV](https://auth0.com/learn/sports-centric-streaming-service-fubotv-sees-50-roi-just-auth0s-security/).

## Stop Maintaining, Start Innovating

As EAs know, “maintenance costs” aren’t as simple as a single line on a budget. Every hour of developer time spent struggling with issues like identity has hidden costs in terms of increased time-to-market, a missed chance to integrate with new technologies, and a fundamental distraction from the brand’s core product.

Conversely, partnering with a trusted third-party like Auth0 for identity management ensures that the critical issue of authentication is always updated to be as secure and compliant as possible, across all your brands. With less frustrating administration, EAs can be more effective leaders, spending less of their time and budgets on identity, and more on getting the big wins. If you’re interested in offloading this demanding work to dedicated experts, contact Auth0 to learn how you can start saving your time, energy, and budget.

<include src="asides/AboutAuth0" />


How Enterprise Architects Can Cut Maintenance Costs in Multi-brand Media

Enable your upmarket strategy with the right technical infrastructure



Enterprise customers are demanding.

Long sales cycles, filled with requests for custom features and integrations, can monopolize your developers and your sales team. If a contract falls through, a lot of time and money will fall through with it.

But the [_move upmarket_](https://auth0.com/blog/how-to-go-upmarket-and-grow-your-revenue-by-20x/) doesn't need to be such a struggle. If you're willing to slightly alter your sales strategy, you can quickly impress new clients and close enterprise deals.

Enterprise clients present three primary challenges to growing B2B companies:

1. **Legacy technology stacks**: Enterprises prioritize stability and often favor products from companies that have long histories in their industries.
2. **Intensive security demands**: Enterprises handle large volumes of data that make security breaches especially risky.
3. **Unique needs**: Enterprises have numerous stakeholders who need to be satisfied, some of whom will demand simplicity and others customization.

With Auth0's [_B2B federation_](https://auth0.com/b2b-enterprise-identity-management/), you can shorten the sales cycle with compatible infrastructure, ensure that the connections between your product and their employees are secure, and address their unique needs with custom configurations.

![Auth0 helps B2B companies grow](https://images.ctfassets.net/23aumh6u8s0i/76cbcjek9FIZY6nxQmvdZR/f0a096097a955ecfb53f099394e91092/b2b_1)

## Offer Compatibility Options to Shorten Your Sales Cycles with Enterprise Customers

The bigger an organization gets, the more internal and third-party tools — all potentially built on different stacks with different protocols — are likely to be in use. The person you're initially selling to might not even know all the infrastructure complications lying in wait.

A primary example is identity and access management (IAM) providers. Your ability to integrate with whichever provider your customers use can drastically shorten or lengthen the sales cycle. If they use Active Directory (and _[hundreds of thousands do](https://auth0.com/blog/analysis-of-enterprise-connections-data/)_), you'll need to implement that before you can close the deal.

If you let the sales cycle stretch out (already _[estimated at 3-6 months](https://saasmetrics.co/benchmark-for-b2b-saas-sales-cycles/)_ for deals that exceed \$100,000 in annual contract value), your internal advocate might move to a different position or company, or the benefits of your initial pitch might not remain relevant. Meanwhile, you might be losing out on other opportunities as you pay expensive developers to make your back end work with theirs.

Worse, if your next customer has a different back end, you'll have to do it all over again.

Auth0 offers B2B federation that _[integrates with 10+ IAM providers](https://auth0.com/blog/how-enterprise-federation-helps-shorten-the-sales-cycle/)_. With a few lines of code, you can configure any enterprise connection, including Active Directory, LDAP, ADFS, SAML, and more.

![Auth0 enterprise connections](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation provides the technical compatibility that makes your product more trustworthy and easier to use. By configuring your app with Auth0, you effectively configure it for numerous providers at once.

A sustainable [_enterprise sales strategy_](https://sapphireventures.com/oiling-the-enterprise-it-sales-engine/) builds from one company to the next, so you don't need to start over each time.

<include src="TweetQuote" quoteText="Auth0 offers B2B federation that integrates with 10+ IAM providers. Active Directory, LDAP, ADFS, SAML? Bring it on!"/>

## Show Enterprise Customers They Can Trust You

High-profile [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) have made enterprises increasingly risk-averse. To a wary enterprise, another partnership might seem like another vulnerability. New products, though they might be valuable, risk widening an enterprise's attack surface.

Enterprises are more likely than SMBs to have security and compliance teams that will take a critical look at your product. These teams need more than assurance. Their input for your service-level agreements will go beyond up-times and scalability and into strict security parameters and compliance standards.

If you provide federation through Auth0, however, maintaining security and compliance in the authentication process is much easier. Auth0 combines the simplicity of a federated identity provider with customizable security features. Your customers can enable tools like multi-factor authentication (MFA) and reinforce compliance procedures as necessary.

![Auth0 multi-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/5zHCdntb8UHVwFG6QBnhd4/2b9f2ba4cfbcab1461b35f82e76d4e8c/why-federation-is-your-secret-weapon-for-enterprise_auth0-multi-factor-authentication)

With MFA, your enterprise clients know that access to sensitive materials won't be granted to anyone with a username and password. Despite these barriers to malicious access, administrators can approve requests easily across a variety of devices.

Guardian, Auth0's MFA application, also provides Mobile SDKs for [_iOS_](https://auth0.com/docs/multifactor-authentication/developer/libraries/ios) and [_Android_](https://auth0.com/docs/multifactor-authentication/developer/libraries/android) that enable you to build a white-labeled MFA application that matches a customer's branding.

Auth0 is compliant with a [_wide range of security, privacy, and compliance standards_](https://auth0.com/security/), such as HIPAA BAA, SOC 2 Type II, and PCI DSS, so you can demonstrate an understanding of your customer's industry-specific needs.

If you're competing with other products that have similar value propositions, the trust you build with enterprise customers can tip a decision in your favor. With Auth0 backing you, it's easier to address concerns from security and compliance teams. The faster and better you can satisfy these stakeholders, the closer you can get to completing a deal.

<include src="TweetQuote" quoteText="Auth0 is compliant with a wide range of security, privacy, and compliance standards such as HIPAA BAA, SOC 2 Type II, and PCI DSS that lets you cover your customer's industry-specific needs."/>

## Sell across Organizations with Single Sign on and Customization

Selling to an enterprise requires selling across levels and [_pleasing different parties_](https://www.copper.com/blog/enterprise-sales-prospecting). Your point of contact might be excited by the core value proposition, but the project managers might be worried about its execution. If all decision-makers aren't in agreement, a deal months in the making can fall apart.

Authentication can be a significant hurdle. IT staff, for example, might resist a new product if it threatens to increase their account-management workloads. Other stakeholders might resist the sheer addition of more credentials to memorize.

Single sign-on (SSO) can dispatch these concerns. With Auth0, employees will only have to enter their credentials once.

![Auth0 single sign-on](https://images.ctfassets.net/23aumh6u8s0i/51MTEF6y286lEpPFiuWMMC/5b67cb0f5643bb655fe06ddf981240cc/why-federation-is-your-secret-weapon-for-enterprise_auth0-single-sign-on)

Enterprises have a higher volume of users and tools, so the ability to sign on once is compelling.

Safari, a company that provides access for corporate learning materials, [_leveraged Auth0's SSO capabilities_](https://auth0.com/learn/safari-case-study/) to expand to enterprise customers. SSO cut support calls for account management without Safari having to dedicate specialized resources. They have since added numerous enterprise customers, differentiating their offering with easy authentication across desktop and mobile devices.

If you need to make integration and usage even smoother, Auth0 also provides customizable _[Rules](https://auth0.com/docs/rules)_. With this customization engine, you can make unique authentication and authorization stages for the customers that need it.

You can use Rules to assist migration by reusing information from existing databases, maintain a white list for particular users, notify systems of login attempts, and more.

## Moving Upmarket Requires a Renewed Strategy

Moving upmarket is more complicated than aiming your sales team at a different target. While you might be able to [_validate product/market fit_](https://www.intercom.com/blog/podcasts/the-myths-of-product-market-fit/) with smaller companies first, moving to enterprise clients requires significant planning.

Moving too fast can threaten your stability. A big contract might seem like a win at first, but without a [diverse customer base](https://www.inc.com/magazine/201606/jason-fried/saying-no-to-large-enterprise-customers.html), too much of your sustainability might hinge on a single large customer. If you shift your business to serve only a few clients, then your future belongs to those contracts—and that's a position no one wants to be in.

Closing deals with enterprise customers means closing the gap between a legacy provider's track record and your ability to meet the needs of your customer. The better you can tailor your product to their needs, the more you'll be able to _[shorten the sales cycle](https://blog.getbase.com/3-hurdles-slowing-sales-cycle)_ and build more valuable relationships for the long-run.

<include src="asides/AboutAuth0" />


Why Federation Is Your Secret Weapon for Enterprise

Enterprise SSO ensures better productivity, user experience, and security for employees through single-click access.



Leading up to the 2016 U.S. presidential election, Russian hackers allegedly attacked the Hillary Clinton campaign and the Democratic National Committee with [spear-phishing](https://www.pcmag.com/article/354240/spear-phishing-attacks-what-you-need-to-know) efforts to trick users into providing their usernames and passwords to fraudulent websites.

As cybersecurity concerns continue to mount, user credentials demonstrate a universal weak point in corporate security, and the more accounts and logins employees and IT departments must manage, the more hackers can find valuable openings. 

So how do companies navigate these risks in a world constantly pushing for more SaaS application use as they grow in size?

One answer lies in SSO, a way to enable single-click credentials and secure identity verification while also improving user experience. 

## What is SSO?

SSO—Single Sign-on—acts as a holistic, single login point where users enter one set of authentication credentials that grant access to a suite of other applications, regardless of the platform, technology, or domain used. 

Picture an office building with unique offices for a variety of related but separate businesses, each with their own key. 

But if it were using an SSO-like system, authorized personnel would instead use one key to get through the front door, sparing them the hassle of using separate keys to get into the individual offices. 

This is the general idea behind how SSO systems work for services like G Suite — where your Google account login gives you access to a variety of individual applications — and Slack. 

### How does SSO work?

Users begin their SSO experience by logging into a gateway, which can be displayed in a variety of ways, depending on the application a company uses. 

With Auth0, users are redirected to a login page with username and password fields, and may include Social Identity Providers such as LinkedIn, GitHub, Google, etc.

![Example Auth0 login screen - SSO in background](https://images.ctfassets.net/23aumh6u8s0i/3nHe9HYJtL71aEhJwAmUms/cbb668c190ab9abca22db8642f6b0084/enterprise_sso_auth0_example)

From there, the users go through the following steps: 

1. They enter their master username and password
2. The credentials are run through the Identity Provider (IdP) for verification, where the authentication server checks the credentials against the directory that contains stored data
3. If the credentials check out, the authorizing server will set an SSO cookie 
4. Users are then redirected to the application they want to access

In the future, users won’t have to see a login screen when accessing any approved application integrated with the SSO setup. 

Instead, when users want to log in:

1. the IdP checks to see if there is an existing SSO cookie; 
2. if necessary, the provider updates the cookie; and 
3. the IdP returns an ID token containing the users' identity information and logs them in. 

Note: During this process, users don’t see a login screen and are seamlessly directed to the dashboard of the application they’re looking to use. 

## 1. Enterprise SSO Improves Employees' User Experience

By using [enterprise SSO](https://auth0.com/single-sign-on), companies save employees time and effort by asking them for only one login and one set of credentials. 

These credentials work for all cloud, on-premises, and mobile applications and provide a hub for all company applications, rather than requiring employees to remember usernames and passwords for each tool.

SSO also provides employees with a more personalized experience by bringing all of their tools and resources into one hub. 

## 2. SSO Provides Multiplatform Access

<include src="TweetQuote" quoteText="Universal access provides employees with the flexibility they expect in the modern workplace and ensures IT security against the threats inherent in modern digital life"/>

By giving employees a single point of login, companies seamlessly provide their teams with multiplatform access. 

With recent studies showing that small companies use a mean of [13.4 different applications](https://www.intermedia.net/assets/pdf/Osterman_-_Survey_on_Application_Use_Within_Organizations.pdf), and large companies boast an average of [more than 15 applications](https://www.intermedia.net/assets/pdf/Osterman_-_Survey_on_Application_Use_Within_Organizations.pdf), SSO allows companies to reduce the chance of employees losing, reusing, and sharing passwords across a multitude of accounts.

That means employees aren’t limited to accessing key tools and resources only at work: They can also securely log into these applications from their homes and mobile phones or access them while traveling.

![Google G Suite apps panel](https://images.ctfassets.net/23aumh6u8s0i/yEX0HHdnz6XJUO4aPYhpj/c97ba95f168fe8d8d41061f18a5dd93b/enterprise_sso_google_apps)

[Source: [Google](https://gsuite.google.com/)]

This universal access provides employees with the flexibility they expect in the modern workplace and ensures IT security against the [threats inherent in modern digital life](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/).

## 3. Enterprise SSO Ensures More Secure Passwords

While employees objectively know they should create hard-to-guess passwords, the impracticality of remembering complex credentials often results in the reuse of weak passwords over and over again. 

In fact, [nearly 90% of people ages 18–30 use the same password_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) across multiple accounts. 

When employees give in to the demand for increasingly complex passwords in order to thwart hackers, the frequency of password recoveries skyrockets. Because of these complex password requirements, [_60% of people need to reset their passwords every 60 days_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) — a practice that also [_costs companies an average $179 per employee_](https://www.pingidentity.com/en/company/blog/2015/11/13/passwords_will_die_a_slow_death.html) [_per employee_](https://www.pingidentity.com/en/company/blog/2015/11/13/passwords_will_die_a_slow_death.html) and is largely avoidable with SSO.

When companies embrace enterprise SSO, team members have to remember only one master set of credentials. This prevents them from creating unique, complex sets of passwords, reusing weak passwords, or [_keeping physical records of all passwords_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) — all of which are inconvenient, costly, and insecure. 

<include src="TweetQuote" quoteText="Companies looking to save their employees time and provide peace of mind while improving individual and network-wide security can set up SSO with the help of Auth0."/>

## 4. Enterprise SSO Boosts Employee Productivity

Utilizing SSO for employees boosts productivity by reducing the time teams spend locked out of key tools while waiting for password resets and getting set up on new applications. 

Employees are also much more likely to know about and take advantage of resources and tools that make their jobs easier and faster and answer common user questions when those applications are linked to one hub, as SSO allows. 

## How Does a Company Set Up Enterprise SSO?

Companies looking to save their employees time and provide peace of mind while improving individual and network-wide security can [set up SSO with the help of Auth0](https://auth0.com/learn/how-to-implement-single-sign-on/).

Beyond the technical aspects of the switch, companies should keep in mind the following rollout tips to help their teams adjust to an SSO setup:

* Make sure to carry over login information so team members don’t have to reenter everything.
* Provide clear direction for users.
* Identify key applications that employees often use, including key software, cloud accounts, and social media. 


4 Vital Ways Enterprise SSO Saves Your Employees Time and Provides Peace of Mind

justin-hinerman

Justin is a Software Engineer at Auth0, focusing on solving authorization challenges for customers. Before Auth0, Justin spent several years as an Identity Management consultant and architect. It was in this job that he came to appreciate the many challenges customers face when trying to implement identity. This knowledge informs his current work at Auth0, trying to make identity as simple as possible for our customers. In his free time, he enjoys spending time with his family, playing soccer, camping, traveling, and playing drums.

Software Engineer

Justin Hinerman

Auth0 now provides your own custom domain for login with a central authorization server.



## Using Custom Domains to Brand Central Authorization Servers

Authenticating with a provider through a central authorization server provides you with a standards-based, maintainable, and secure login approach. This type of login also provides single sign-on benefits and a modern user experience. You can explore the[ benefits of this architecture further in this blog post](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/).

For those who are not familiar with the concept, you may have noticed that you are always redirected to [accounts.google.com](https://accounts.google.com) when you log into Google sites such as Gmail or Youtube. Google has a _central authorization server_ that is used across all of their applications and third-party apps.

![Google central authorization server](https://images.ctfassets.net/23aumh6u8s0i/7CnL0OedgtBQGe3FxUbyfE/f94f36fcd0c31e2fccd6570b1d6c8fb7/google)

Auth0 provides this same capability out of the box, allowing you to unify login for your own brand and products. Enabling Auth0's central authorization provider, [Universal Login](https://auth0.com/docs/hosted-pages/login), is easy, straightforward, simple to configure, and can be customized to suit your brand.

Customers who prefer this experience to be served from their own domain, instead of `[your-account].auth0.com`, can configure their own custom domain in Auth0. This feature is available for all free-tier customers. Adding your own custom domain to an existing implementation only requires small code changes thoroughly detailed in our [custom domain setup docs](https://auth0.com/docs/custom-domains#step-3-complete-feature-specific-setup). Simple configuration can be completed within your Auth0 dashboard.

<include src="TweetQuote" quoteText="You can configure your own custom domain in Auth0. This feature is available for all paid customers."/>

## Benefits of Using a Custom Domain

### End-User Benefits

By using a custom domain for your authentication page, you keep your users interacting with you within the context of your brand, which helps you build brand loyalty. Users are not redirected to a third-party site that breaks the branding context. This prevents users from becoming confused about whether or not they are still running a transaction or operation with you.

For example, if your Auth0 domain is `northwind.auth0.com`, you can have your users to see, use, and remain on `login.northwind.com`.

<include src="TweetQuote" quoteText="Using a custom domain with Auth0 allows your users to feel confident that they are providing their credentials to the right party. Authentication happens within the context of your brand."/>

Auth0 support for custom domains allows us to do the authentication heavy lifting for you without compromising your branding experience.

### Customer Benefits

Brand loyalty from users is a pillar for the success of an organization of any size. One of the ways to build brand loyalty is by offering a consistent branding experience to users. It's important that your users always feel that they are interacting directly with you to avoid confusion or session abandonment.

From the security point-of-view, using [Universal Login](https://auth0.com/docs/hosted-pages/login) is the preferred way to handle end-user credentials. It allows you to have comprehensive control of authentication in one centralized place, as opposed to having individual applications handling credentials. Consequently, having your authentication services contained in one place will make your application architecture more maintainable. Applications are only given the access they need and authentication services can be scaled easily.

You can mitigate certain phishing attacks when your users expect to run transactions within your domain. Having that domain consistency will allow your users to easily and quickly reject phishing attempts.

Universal Login also offers you simplicity as an implementation advantage. You don't have to worry about integrating login user interfaces into different applications. When you use Auth0 Universal Login, you get all the features you need in the fastest possible way: redirecting to a common login interface. Adding custom domains to this workflow creates a seamless experience for your developers and end-users.

## Custom Domain Authentication Features

Core Auth0 features and flows support the use of custom domains:

* OAuth 2.0/OIDC-Compliant Flows (those using the `/authorize` and `/oauth/token` endpoints).
* Database and Social Connections.
* SAML Clients and Connections.
* A full list of features supporting the use of custom domains is available in the [feature section](https://auth0.com/docs/custom-domains#features-supporting-use-of-custom-domains) of our custom domains document. New features, such as enterprise connections, will be added to the list as they become available. Keep an eye on that space!

## How It Works

To [configure your custom domain with Auth0](https://auth0.com/docs/custom-domains#how-to-configure-custom-domains), go to your account settings, select Custom Domains, add your own domain, and follow the instructions.

![Auth0 custom domains tenant settings](https://images.ctfassets.net/23aumh6u8s0i/4sOb3yHNVMECyroBboPtTX/11e347f12d8b3ee97b028818e021cbfc/custom-domain-setup-auth0-dashboard.png)

You will need to complete a [verification process](https://auth0.com/docs/custom-domains#step-2-verify-ownership) for your domain that varies depending on whether you decide to use an Auth0-managed or a [self-managed certificate](https://auth0.com/docs/custom-domains/self-managed-certificates#step-2-verify-ownership).

Your existing integrations using your `[your-account].auth0.com` domain will continue to work. After migration to your custom domain is complete, users will have to log in again since existing sessions will no longer be valid.

## Custom Domain Self-Service

Different than other solutions, Auth0 not only gives you the option to use a custom domain, but Auth0 also empowers you with full control over setting up and using your custom domain for authentication. Flexible self-service options are available through our Dashboard for you to directly handle selecting, verifying, and implementing your custom domain. You don't have to wait on us for anything to complete this process. You are in charge.

## Using Custom Domains with Auth0

[Atlassian](https://www.atlassian.com/) is an early-adoption Auth0 customer using a custom domain. Atlassian is consolidating all of their B2B and B2C products under a central authorization provider at [id.atlassian.com](https://id.atlassian.com).

![Atlassian central authorization provider](https://images.ctfassets.net/23aumh6u8s0i/6gwmZK2fxPEmUWFZ1t4Tdf/85045a917ff13e7b2951a593aa836a03/atlassian)

Other Auth0 customers currently using custom domains with a central authorization server include [AGL](https://www.agl.com.au/residential), [National Life Group](https://www.nationallife.com/), and [News UK](https://www.news.co.uk/).

With the launch of custom domains with Auth0, your users will benefit from a first-class login experience, while keeping your brand through a trustworthy domain.

<include src="TweetQuote" quoteText="Using custom domains with Auth0 allows your users to benefit from a first-class login experience while keeping your brand through a trustworthy domain."/>

For more information, check out our [Custom Domains documentation here](https://auth0.com/docs/custom-domains).


Take a No-Compromise Approach to the Login Experience Using Custom Domains

sam-judson

Former Auth0 Employee

Samuel Judson

Duo Security announced the discovery of a new class of SAML response vulnerability affecting SSO. Auth0 is not vulnerable to this issue.



On February 27, 2018, [Duo Security](https://duo.com) announced the discovery of a new class of vulnerability affecting SAML-based single sign-on systems. This flaw can allow an authenticated attacker to fool SAML systems into logging in as a different user, even without knowledge of the victim’s password. Note that this type of attack can be prevented by Multi-Factor Authentication, even if software used is vulnerable.

Malicious impersonation of this type can have a broad range of risks, including (but not limited to) compromising the victim as well as the system. An attacker could potentially impersonate a user with greater permissions, as well as elevate their own privileges.

Researchers from [Duo Labs](https://duo.com/labs), Duo’s security research team, identified several vendors affected by this class of vulnerability. You can read more information on SAML, details of the exploit, and affected vendors in Duo’s announcement here: [Duo Finds SAML Vulnerabilities Affecting Multiple Implementations](https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations).

## Auth0 is Not Affected by the Vulnerability

As [cited in Duo’s disclosure](https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations), all three of the following items are needed in order to enable this vulnerability:

1. SAML Responses contain strings that identify the authenticating user.
2. XML canonicalization (in most cases) will remove comments as part of signature validation, so adding comments to a SAML Response will not invalidate the signature.
3. XML text extraction may only return a substring of the text within an XML element when comments are present.

The library that Auth0 uses internally to parse SAML responses prevents the third requirement for exploitation. This prevents the vulnerability being exploited when  Auth0 is used as a SAML Service Provider (SP).

## Am I Affected?

Auth0 is not vulnerable to this issue, therefore, Auth0 customers do not need to take any action if using Auth0 as a SAML SP. However, if you are using Auth0 as a SAML Identity Provider (IdP) and are _processing SAML responses in your own code_, you will need to verify whether the libraries you are using are vulnerable as per [the original disclosure from Duo](https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations). If you are using a vulnerable library, you must ensure that **any affected software is updated to patch the vulnerability**.

Auth0 provides the [passport-wsfed-saml2](https://github.com/auth0/passport-wsfed-saml2) Passport strategy as open-source software. This strategy is **not vulnerable** to this SAML security vulnerability reported by Duo. If you or your company are using this strategy, you do not need to take any additional action.

If you have any further questions or concerns, please [open a support ticket](https://support.auth0.com/) or [ask in our community forum](https://community.auth0.com/).


Auth0 Not Affected by SAML Vulnerabilities Identified by Duo Security

Learn how enterprises are taking back control of managing, tracking and securing their employee's mobile devices.


**TL;DR:**  Learn how enterprises are taking back control of managing, tracking and securing their employee's mobile devices.

You probably don't realize it, but your colleagues and you have been leading a technology revolution against your company's IT department. The day you handed in your corporate-issued Blackberry and started using your personal devices to conduct business was the day you inadvertently declared war on IT.

![Source](https://images.ctfassets.net/23aumh6u8s0i/pUmIPSCGzHyj26w3bhH6d/56aa08eb4144b70aea29f61649d41f86/it-war)

Before this revolt, IT enjoyed complete control your organization's devices, applications, and data, which made it easy to keep information secure and the systems working within the requirements of the enterprise. This all changed when employees took IT into their own hands, otherwise known as [Shadow IT](https://www.informationweek.com/cloud/shadow-it-its-much-worse-than-you-think/a/d-id/1321637?).

Your consumer-focused mobile applications were so easy to use and enhanced your productivity to a point where it made sense to start using these same applications for work. You set up Dropbox to share your team's confidential documents, you started collaborating in Google Docs, and you built presentations on Prezi.

![Source](https://images.ctfassets.net/23aumh6u8s0i/6J2aXnEp5NJjxHAZnTVBYN/ace0c9ba4fa8ce22716e9797a79a12bd/Shadow-it-happens)

While you didn't think twice about using these apps, IT had a big problem on its hands. Workers started using [hundreds](http://www.itmanagerdaily.com/study-a-majority-of-workplace-apps-are-shadow-it/) of unsanctioned apps and accessing them outside of the office on their mobile devices. This blitz on the enterprise grew into a major security liability. Something had to be done.

## The Rise of Enterprise Mobility Management (EMM)

IT had a unique challenge to solve: how could they secure and track the confidential information living on their employee's mobile devices without impeding on the flexibility and productivity that employees now relied on to conduct business?

Enterprise mobility management (EMM) emerged as the solution, with the idea of helping IT take back control of the business-related applications and data living on employee devices without actually interfering with their personal apps.

<include src="TweetQuote" quoteText="Simply put, it is a set of services and technologies that work together to secure company-owned applications and data on your employees’ mobile devices."/>

EMM is still in its infancy. Simply put, it is a set of services and technologies that work together to secure company-owned applications and data on your employees’ mobile devices. While the concept is straightforward, the complexities to achieve this goal require completely new technological approaches that continue to evolve.

![Source](https://images.ctfassets.net/23aumh6u8s0i/1uyDEbLJKZv251Igzkp6Mk/fc042c1a9e98865303e3605890c8b4d7/emm-technical-challenges)

The volume and variety of mobile applications, operating systems and device types that need to be considered create the challenge for building EMM solutions. David Johnson, a principal analyst at Forrester Research, [upped the ante ](https://www.computerworld.com/article/3230510/mobile-wireless/what-is-enterprise-mobility-management-emm.html) extending EMM beyond mobile management:

> *EMM used to be mainly about mobile device and application management, but now it’s more about enabling mobility more broadly – extending to Windows 10 and MacOS devices, identity and access management strategy, and how to design mobile engaging and productive mobile experiences for employees.*

With so many moving pieces, the definitions and expectations of EMM continue to evolve. In order to get a solid grasp on where EMM is and where it's heading, it's helpful to look at the four areas currently driving the EMM strategy.

## 4 Components of EMM

We apologize in advance for the onslaught of [acronyms](http://thecontextofthings.com/2014/02/06/whats-up-with-the-over-use-and-obsession-on-acronyms-in-american-business-and-professional-culture/), but the best way to define EMM is by explaining its core components: MDM, MAM, MCM, and MIM.

While EMM can manifest itself in different ways depending on your requirements, the technology suite is primarily focused on managing four important aspects of mobile:

1. **Device: **Mobile device management (MDM)
2. **Applications: **Mobile application management (MAM)
3. **Content: **Mobile content management (MCM)
4. **Identity: **Mobile identity management (MIM)

![emm-platform](https://images.ctfassets.net/23aumh6u8s0i/23grw37EUvrZ85A5y7akCj/7b0c4cbdcb0ef2f324e322e63c56c772/emm-platform.png)

EMM is the comprehensive method of remotely managing devices, which is accomplished by incorporating the aforementioned four tools and strategies.

### 1. What is Mobile Device Management?

MDM is mistakenly used interchangeably with EMM. While MDM focuses on the device being secured, EMM encompasses both the device and the information which isn’t always stored in the device.

With MDM software, IT administrators can oversee mobile devices in the same way they manage your desktop computers in the office. They can remotely enroll the device and then track it, manage it and secure it based on the employee's profile and tasks.

![Source](https://images.ctfassets.net/23aumh6u8s0i/6L0odS5xyll40kQKpVouhz/f932ccd48d85281fc34031d5e7b9ca21/Mobile-Device-Management2)

The company can access your device to provision and configure Wi-Fi access, install and update apps, and fix any problems on the device. IT can also enforce security measures on the device such as locking out a device and wiping data.

### 2. What is Mobile Application Management?

MAM refers to the delivery and administration of the enterprise's software to the employee's device. While MDM focuses on device activation, provisioning, and troubleshooting, MAM tools deliver and manage all aspects of the mobile software (applications).

An important feature of MAM is providing the ability for IT to wipe company-owned apps and data remotely, without affecting the user's personal items.

![Source](https://images.ctfassets.net/23aumh6u8s0i/54eQbaZlFEfona8O2g2Yps/aa6be9ce02315c81dbd84f4e66dd48ec/mam-diagram-app-level_desktop)

The admin can also blacklist or whitelist applications and control their access permissions, which helps combat sensitive data flowing through unsanctioned applications.

When combined with MDM, MAM solutions can help IT better understand employee usage of the enterprise applications with behavioral analytics.

### 3. What is Mobile Content Management?

MCM uses a set of technology tools that secure access and storage of confidential content by implementing an encrypted, managed container.

Instead of storing important, company-owned content on personal apps like Dropbox or Google Drive, employees must adhere to the MCM policies for accessing and storing content and use the enterprise's preferred application. This not only keeps corporate content separate from personal but also gives IT the power to delete content from the device at will.

![Source](https://images.ctfassets.net/23aumh6u8s0i/64TMnRdcG4VDeutP1l7tNA/12aadff09555d571eb3deb51bbff5e9f/mobile-content-mgmt)

MCM is most effective when incorporated with MAM and MDM to ensure management of each level of the mobile enterprise. Identity management becomes the final component to keeping each level secure as it gives IT control over end-user access to specific apps, content, and sets of data.

### 4. What is Mobile Identity Management?

MIM is designed to ensure that only trusted devices and users can access enterprise data or applications. By authenticating the user’s identity and then tracking their activity, MIM gives IT the tools to manage access across devices and applications beyond the firewall.

Tools like [Auth0](https://auth0.com/), give administrators the ability to implement access security through:

* **Two-factor authentication:** [2FA](https://auth0.com/learn/two-factor-authentication/) provides an extra layer of security if a mobile device is lost or stolen. By asking for a second form of identification such as an SMS code; if credentials are ever compromised, the data is still secure.
* **Behavioral Alerts:** Auth0 provides [custom tools](https://auth0.com/docs/anomaly-detection) to detect anomalies and stop unauthorized access. By tracking behavior and geography, MIM tools will alert IT of suspicious activity and attempts to log in.
* **SSO (single sign-on):** [SSO](https://auth0.com/docs/sso/current) allows users to use one set of credentials to access multiple applications. When enterprises use dozens of apps, SSO gives employees the convenience of access without tedious logins for every app.

![Source](https://images.ctfassets.net/23aumh6u8s0i/27ARow6G5c3pb78x2Aq8H5/de558db7492ffb25b10c820fa9ddaba2/identity-mgmt)

Identity management is the glue that keeps MDM, MAM, and MCM secure. Each of these components serves a specific purpose within the EMM framework, but as they are incorporated into a cohesive system, enterprises are able to gain back control of their digital assets.

## How to Choose an EMM Provider

The technology suite of tools and services needed to deliver a complete EMM solution currently does not exist within one single vendor.

EMM is rapidly evolving, and there is a lack of industry standards and best practices. Like most IT initiatives, start your EMM vendor search by developing a set of objectives and requirements. Define your needs and research vendors based on individual capabilities.

Here are 4 questions to get you started:

1. **Do you offer application, content and identity management?** While most EMM products focus on device management, not all of them cover other aspects of mobile management.
2. **Do you support the platforms and technologies that we use?** Some EMM providers only support certain operating systems and devices. Don't assume they cover everything you need.
3. **What is your security approach for device and data?** Ensure your vendors are using the most advanced encryption and [identity tools](https://auth0.com/security) that comply with your security policies. 
4. **Does the technology integrate with the current infrastructure?** If you have a complex infrastructure, you will want to make sure the EMM solution integrates with your system. 

Choosing the right vendors comes down to analyzing their capabilities within the core competencies of EMM. Take each component and evaluate providers on their capabilities to deliver on these elements.

According to Gartner's Magic Quadrant [report](https://www.air-watch.com/resources/analyst-reports) on EMM:

> There are diverse vendor approaches to managing the mobile lifecycle, with many focusing on identity and access, content security, and containment. To be classified as an EMM suite, Gartner requires inclusion of MDM, MAM and at least one of the following: MIM, MCM or containment technologies. The most advanced suites will include all five technologies.

![gartner-quadrant-report](https://images.ctfassets.net/23aumh6u8s0i/52uhtpHVlYtii773TRiqA3/fcf0154e5fc23e244bc6307a843fd46d/gartner-quadrant-report.png)

While Gartner highlights vendors that try to incorporate several components, finding experts in each area might be a better way to go during the early stages of EMM. Niche providers that focus on one aspect of EMM often develop an expertise and can adapt quickly to the changing market.

Whether you choose an all-encompassing solution or create a suite of niche tools, partner with companies that have a vision for EMM and a roadmap for how their solutions will adapt as mobile matures.

## EMM Solutions Beyond Your Phone or Tablet

<include src="TweetQuote" quoteText="Enterprise mobility management is IT's answer to the employee revolution that forced companies to rethink their technology and data policies."/>

Enterprise mobility management is IT's answer to the employee revolution that forced companies to rethink their technology and data policies. EMM is not retaliation against employee mobility; it is actually the opposite. Companies want to keep their employees mobile and productive.

The future of EMM is going to be exciting as the definition of 'mobile device' expands to other connected devices, such as wearables and personal assistants. When [Alexa](https://en.wikipedia.org/wiki/Amazon_Alexa) starts helping people do their job, EMM will need to be ready.


What is Enterprise Mobile Management (EMM)?

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn how a B2C Company implemented Single Sign-On to provide seamless integration between different e-commerce portals.

Implementing Single Sign-On in B2C Applications

Security measures should augment productivity, not impede it



Your company would never let a random person walk through the front door of the office without authorization, grab a cup of coffee and start going through confidential files. In the digital workplace, this is exactly what is happening, minus the coffee.

Today, work happens in the cloud on multiple devices, which means your company's data and systems are accessible from anywhere.

You have to find new ways to manage your employees' identities and permissions, so the right people have access to the right systems and data. While security is critical, adding too many security measures hampers productivity.

So how do you balance security and productivity within [the modern digital workplace](https://www.interana.com/blog/how-leading-companies-are-tackling-the-challenges-of-digital-transformation/) where employees are using unsanctioned devices, running hundreds of applications and sharing company resources with outside partners?

Start with an identity and access management (IAM) tool that is designed to keep up with the pace of digital transformation.

### Simplify the digital workplace with IAM

Software for businesses is booming. But hundreds of applications running on unsanctioned devices poses a huge security risk and keeps IT professionals up at night.

While the complexities of managing access across so many tools and devices is a huge challenge, the benefits of the digital workplace are ushering in a new era of productivity where employees can work anytime, in any place with anyone around the world. [Digital transformation](https://www.interana.com/blog/curiosity-got-cat-promoted/) is moving fast, and it's your job to stay ahead of the game.

![The complexity of one employee's digital workspace](https://images.ctfassets.net/23aumh6u8s0i/3ILL4BCkM5rTmj9j8Y7aXd/f1114e008ecd6950c0173d3841eb0861/complexity)

[[Source](http://www.zdnet.com/blog/hinchcliffe/)]

That's why cloud IAM tools, like [Auth0](https://auth0.com/b2e-identity-management-for-employees), are growing so quickly. IT departments no longer need to manage access and authorizations in-house, or scramble to keep up with securing every new application and cloud system that employees bring into the corporate environment.

IAM tools simplify the complexity of the digital workplace by managing all of your user identities and access permissions across your internal systems, employee devices and cloud-based technologies. All of your users, both internal and external, are authenticated and authorized based on the roles that you set within one easy-to-use system.

IAM allows you to keep up with the pace of technology, but more importantly, the security features are designed to enhance productivity. Your organization can maintain high-level security measures, while removing the barriers that interrupt a productive workflow.

### Better productivity without a security compromise

Employees expect a quick and seamless experience when accessing all of their tools. When a user can't log in or is locked out, valuable time is lost contacting a help desk. Productivity comes to a screeching halt.

The whole point of [digital integration](https://amplitude.com/blog/2017/05/18/analytics-stack/) is to be more productive by eliminating tedious and repetitive tasks, including logging in to multiple applications every day. So how can you keep security and permissions in place while eliminating individual logins for every single application? Single sign-on.

In the same way your Google sign-on gives you access to several other applications like Google Analytics, Youtube, and Adwords without re-entering your username and password, good identity management will enable your organization to implement a [single sign-on ](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/)for your entire network.

Once users create their single sign-on (SSO) credentials, they'll no longer have to waste time logging in over and over, giving them a seamless work experience regardless of the application, device or domain.

![Single Sign On](https://images.ctfassets.net/23aumh6u8s0i/74KAL716uJ2wcnwhseJXRa/95dad10d4d42fabbd20490467815eb93/singlesignon)

Single sign-on drastically reduces IT help desk tickets and centralizes admin tasks like password resets. When a password is revised, the change automatically updates every app and system connected to the SSO. IT no longer spends all day helping users with access issues, while your employees enjoy a seamless, more productive work experience.

### Added security that provides flexibility

Employees need the flexibility to work on any device or register a new application to conduct business, but the proliferation of 3rd party applications has broadened the security surface area far beyond any internal IT department can manage.

Cyber threats have become an everyday reality for both large and small businesses. The [2016 Cyber Security Intelligence ](http://ibm.biz/2016CyberIndex) found that 60% of data hacks involved an employee's access data. Either a hacker used an employee's credentials or the employee abused their access privileges.

IAM tools that offer [multifactor authentication ](https://auth0.com/multifactor-authentication)(MFA) provide an extra layer of security that allows your team to use any devices and sign up for new applications without the worry of compromising credentials.

MFA is one of the best ways to identify and verify a user. By asking them for several pieces of information through various stages, the user must demonstrate knowledge (E.g. password or pin number) and possession (E.g. mobile phone). For example, a user is prompted to input their password, which triggers an SMS message with a unique code.

![Multifactor](https://images.ctfassets.net/23aumh6u8s0i/1AUVdavXrQLYR1Y5WFA0N0/6f190786a9012296aca348c5474d8887/multifactor)

[[Source](http://it.miami.edu/_assets/images/multifactor1.png)]


When something unusual is detected, such as a sign-in attempt from a new device, MFA requires the user to have two or more types of ID proof before gaining access. If your password is compromised, your account remains safe. Apps like [Auth0 Guardian](https://auth0.com/multifactor-authentication) offer easy setup for MFA security.

Multifactor authentication offers the flexibility for employees to securely access their resources wherever and whenever, enhancing their productivity.

### Automated permissions keeps business moving

The basic idea behind IAM is to grant each user access to their authorized resources using one set of credentials, which helps streamline IT's workload in tracking permissions. But the bigger challenge for IT is in keeping up with each user's ever-changing privileges status.

In a given week, you can have new employees needing access to start working, other people leaving the company who need their access terminated, and a variety of other employees changing roles, who require different levels of access.

Tracking each user's permissions within an organization is nearly impossible. Your IT team shouldn't waste their valuable time trying to keep up with these constant changes.

The right IAM tool centralizes control of identity and access with an interface that helps you manage every aspect of user ID including automating authorizations, creating and provisioning users, password resets and blocking and deleting users.

![Users](https://images.ctfassets.net/23aumh6u8s0i/G9b0mA8dKR8wYPxtlG2g5/abff6316bcae956309520dcb89242cb1/users)

Administrators can stay ahead of the constant changes by defining security protocols for specific applications and granting permissions to users to access resources at different levels from a central control panel. For example, when an employee leaves the company, your human resource system triggers IAM to terminate access for that user.

You can also automate authorizations by setting rules that define user requirements, such as by devices, location or by limiting unsanctioned applications from connecting to your corporate environment.

When an employee's status changes, they can't wait days for access. Automated permissions and centralized user management help you keep up with the daily authorization changes.

### Stay ahead of your company's digital transformation

Your digital workplace is constantly evolving as [technology continues to evolve](https://amplitude.com/blog/2017/04/26/digital-transformation-yellow-pages/). Employees have the tools and access to information to be more productive. The goal is to keep your company's resources secure without hindering this new level of productivity.

The right IAM technology solution should deliver the best-in-class security measures that work to create a flexible and efficient workflow for employees across all of their tools. When users have a great work experience, they probably won't thank you, but they will work faster and smarter, which helps the company succeed.


Enhancing Productivity With Identity and Access Management

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Prosper Otemuyiwa

Anomaly Detection can protect your users from password reuse attacks



Just last week, [GitHub](https://github.com/blog/2190-github-security-update-reused-password-attack) reported that there were several unauthorized attempts—some of them successful—to access a large number of accounts. A thorough investigation revealed that it was an attacker using lists of email addresses and passwords from other online services that have been compromised in the past. As many people use the same password on multiple online services, attackers were able to log in to a number of GitHub accounts. Thankfully, GitHub was not compromised, but some of the accounts were due to this reason.
At **Auth0**, we are aware of this problem and we can help you deal effectively with cases like this. Let's take a deeper look at what Auth0 can do for this kind of situations.  

##  How Auth0 Can Help Protecting Your Users' Accounts

Auth0 provides an awesome security feature called **Anomaly Detection**. It comprises in-built tools that help you detect suspicious activities on your users' accounts, alert them of these activities, and it can also stop malicious attempts to access your application. **Anomaly Detection** provides the following benefits:

- **Breached Password Detections**: Auth0 tracks large security breaches that are happening on major third-party sites to help keep your users and systems secure. By enabling Breached Password Detection, your users can be notified and/or blocked from logging in if we suspect that their credentials were part of a published security breach. The best part? It is enabled just by flipping a switch.

    Enable **Breached Password Detection** using the toggle in your dashboard as shown in the following image:
    <img src="https://images.ctfassets.net/23aumh6u8s0i/43BF3OgSXUqVoBn0SZ7fop/9916b382c30bd69182b207a3c2e86f76/breached-pass-dashboard" alt="Breached Password Dashboard"/>

    When the feature is enabled and a user attempts to login with credentials that were leaked in a security breach, the lock will show an alert:
    <img src="https://images.ctfassets.net/23aumh6u8s0i/g0CUWmcjtMvutd9IFkPRj/500a7928488a5f3c999d82a612c2ec23/breached-pass-lock" alt="Breached Password Lock Error"/>

    Lastly, the user will get the following notification email:
    <img src="https://images.ctfassets.net/23aumh6u8s0i/odAiw5zXCkpup1vmD6rSX/a25932c84e93ea2e200ae83de9e305f1/breached-pass-email3" alt="Breached Password Email" />


- **Brute Force Protection**: Using Auth0, you can easily set a certain number of failed login attempts on your account. If it exceeds that set number, you can block the user, send him an email, and also notify dashboard owners.

Using Auth0, you can easily set up **Anomaly Detection** on your dashboard to protect your users.

<img src="https://images.ctfassets.net/23aumh6u8s0i/3xVVU5KBTl65p3oUrnUWcT/f4808a3c935fb93bf1afd19ae4b328a0/anomaly-detection-overview" alt="Anomaly Detection Overview"/>

You can use the switches to enable/disable all the actions of a certain shield.

<img src="https://images.ctfassets.net/23aumh6u8s0i/3ynZza97bo7fRaaS4etSVe/e942552d16cbdd327d1c961dae6101e6/changing-actions" alt="Changing Actions" />

> Read more about Auth0's Anomaly Detection [here](https://auth0.com/docs/anomaly-detection)

## 5 tips for protecting your passwords

Anomaly Detection is a great tool for protecting your users' accounts, but security should be a concern for all parties. Here are 5 tips that users can take into account to protect their passwords.

### 1 - Don't use the same password across multiple online services

If hackers get hold of your Github password, it shouldn't be an automatic entry visa to your Facebook, Twitter, Instagram, and Snapchat accounts. Having to remember several passwords involves a strong muscle memory, so you can decide to use a password manager to take care of that, but ensure it's a really trusted and secured one.

### 2 - Guard your password

Your password is valuable. Don't share it with anyone, even friends or family. Don't store it in your mail inbox. Make sure it is confidential. If you use someone else's system to log in and perform a certain activity on an online service, don't forget to log out!

### 3 - Change passwords frequently

As bigger companies get hacked, the likelihood that your password is leaked increases. Make a habit of frequently changing your passwords.

### 4 - Two-factor Authentication

**Two-factor Authentication (TFA)** is a method of authenticating users by adding a second factor to validate the user's identity. Typically, it involves entering a one-time token that is dynamically generated and delivered through a method that only the user has access to.

> Learn more about Multifactor Authentication, in the [Get Started with MFA landing page](https://auth0.com/learn/get-started-with-mfa).

With TFA, a hacker must have access to your mobile phone or second factor to be able to gain access to your account.

### 5 - Passwordless Login via SMS and email

With Passwordless Login you can use one-time codes or “magic links” delivered via SMS or email. In this way, only users who have access to the registered email account or registered phone will be able to login.

> Read more about Passwordless [here](https://auth0.com/blog/2015/09/30/auth0-passwordless-email-authentication-and-sms-login-without-passwords/).

![Passwordless Login](https://images.ctfassets.net/23aumh6u8s0i/3QYNw3edBKso3qNe2A6djc/d8449a97f4bb29e325c3459fa495fa99/pwdless-locks)

## Conclusion

Online services are getting hacked on a daily basis, and hackers are also getting smarter every day. We have seen several big companies like Slack, Paypal and LinkedIn experience data breaches. It is never too late to start guarding your users, data, money, and your precious reputation more seriously; until it is too late.

<include src="TweetQuote" quoteText="Online services are getting hacked on a daily basis, and hackers are also getting smarter every day."/>


Avoiding Password Reuse Attacks with Auth0

Learn how to implement social logins on Android with Facebook, Google, Twitter and Instagram as providers

Authenticate on Android Using Social Logins

In this post you'll learn 5 techniques that can prevent your users' accounts from being hacked and would have made Brian happier



Yesterday, _Brian Krebs_ from [Krebs on Security](http://krebsonsecurity.com/2015/12/2016-reality-lazy-authentication-still-the-norm/) reported that his PayPal account had been hacked using one of the oldest hacking methods: **social engineering**, and knowing some pieces of static information about the account owner —the last four digits of an old credit card and the last four digits of the social security number—.

Being a known security expert, Brian had a strong account password; that is, it was long and complex, and used all types of characters. A strong password is mandatory, especially for a service that is directly linked to the user's credit cards. In Brian's case, he soon discovered that it was not his password that was compromised. Instead, the cyber criminal called PayPal customer support, impersonated him, and got access to his account in a matter of minutes, having provided only that static and easy-to-obtain information about the user, not once but twice.

## 5 Things that Could Have Prevented the Hack

In this post, we'll teach you five things you can implement to prevent your users from being hacked. Make Brian safe again!

### 1 - Multifactor Authentication

**Multifactor Authentication (MFA)** is a method of identifying users by presenting several separate authentication stages. Some of those stages could be a Time-based One-Time Password (TOTP), mobile verification, or a hardware token, among others.

> Learn more about MFA, in the [Get Started with MFA landing page](https://auth0.com/learn/get-started-with-mfa).

Believe it or not, most of the biggest retail stores don't provide these additional layers of security or are just starting to provide them. For example, [**Amazon**](http://www.amazon.com) added this option in mid-November without making an official announcement, as reported by [The Verge](http://www.theverge.com/2015/11/18/9753888/amazon-two-factor-authentication-2fa).

With MFA, a cyber criminal must not only know the password, but also possess a mobile phone or token device in order to access the account. Some companies believe that enforcing multifactor authentication could result in the loss of a significant number of users; for those companies, an intermediate solution can be achieved by requiring a second factor only for resetting the password.

PayPal has this option available by using hardware tokens, but evidently this is not required in their password reset flow.

<div class="" style="text-align: center;"><img style="margin: 0; max-width: 200px;" src="https://images.ctfassets.net/23aumh6u8s0i/2LB9dXQu6yRDwVt2oQFwqR/3dba5964313886fdef5f86bcb282c98d/why-is-mfa-necessary" alt="Multifactor Authentication" />
</div>

### 2 - Passwordless Login via sms and email
With Passwordless Login you can use one-time codes or “magic links” delivered via SMS or email. In this way, only users who have access to the registered email account or registered phone will be able to login. If PayPal support had offered this option, they could have ensured that the person claiming access was the legitimate owner by sending an email or SMS with a code or link.
​​
> You can read more about Passwordless [here](https://auth0.com/blog/2015/09/30/auth0-passwordless-email-authentication-and-sms-login-without-passwords/).

![Passwordless Login](https://images.ctfassets.net/23aumh6u8s0i/3QYNw3edBKso3qNe2A6djc/d8449a97f4bb29e325c3459fa495fa99/pwdless-locks)

### 3 - Step Up Security
With **Step Up Security**, critical actions in user accounts—adding or changing email accounts, changing passwords, and so on—require additional security measures. Brian Krebs' attacker called customer support to reset his password. This critical action needed stronger security measures—such as multifactor or passwordless authentication—as the company should have ensured that it was being performed by the legitimate user.

![Step Up Security](https://images.ctfassets.net/23aumh6u8s0i/7MieEkMD4W8csXw1s959XX/136172cf228821b1575b772c930c620e/step-up-security)

### 4 - Trained Support
Companies **must invest** in training their customer support employees in security procedures. This point is often inadequately considered, which leads to situations like granting access to anyone with the sufficient static information. And this in turn will make the company lose its reputation.

<include src="TweetQuote" quoteText="Companies must invest in training their customer support employees in security procedures."/>

However, we have learned from past attacks that social engineering [virtually always will succeed eventually](http://www.wired.com/2014/01/my-epic-hack-revisited/). While training of support staff is needed, it must be part of a larger security strategy. Using a method above to build a system that requires customer verification is an important step in preventing social engineering.

![Trained Support](https://images.ctfassets.net/23aumh6u8s0i/3euV9iQyU0NVBE6W0X8efW/7cf38b6a199db837a7f2280cefffe4fd/trained-support)

### 5 - Single Sign On with Another Service
Using Single Sign-On, once you log into one trusted service or provider, you don't have to enter your credentials again when entering another application that supports it, as you will be automatically logged into all supported applications, regardless of the platform, technology, or domain.

If PayPal had allowed Single Sign-On with another trusted service, it would have added an additional security layer to prevent the hack. A legitimate user who lost his password but could log into a trusted service could easily reset his password without needing to go through customer support.

> Learn more about [Single Sign-On](https://auth0.com/learn/how-to-implement-single-sign-on).

<div class="" style="text-align: center;"><img style="margin: 0; max-width: 200px;" src="https://images.ctfassets.net/23aumh6u8s0i/74MkL0x1mxFBflGp20ecX/222af83745d01410e75bca971c39a390/bg-login" alt="Single Sign On" />
</div>

## Aside: How Auth0 Can Help You Strengthen the Security of Your Application's Accounts
Using Auth0 you can add the following features to your application in a breeze.

- **Multifactor Authentication**: Using Auth0 you can have MFA implemented in minutes! You can use the out-of-the-box providers or easily integrate any different provider using Auth0's extensibility.

- **Passwordless**: [Auth0 Passwordless](https://auth0.com/passwordless) supports one-time codes or “magic links” delivered via SMS or email without having to worry about the implementation details.

- **Single Sign-On**: By taking advantage of our wide range of SDKs you will have Single Sign-On with any Identity Provider running in minutes. Provide your users with a seamless authentication experience when they navigate either through the applications you built and/or third party apps.

## Final Words
What it is interesting is that **PayPal**, populated by a lot of smart people and with more actual experience in online payment systems than almost anyone, relies on inherently insecure procedures. They certainly know everything Krebs talks about in his post, they have the resources to do something different, and yet they don’t. Why Paypal doesn’t have tighter procedures? The answer to that question is probably because their cost of fraud is lower than the cost of implementation. You can be 100% sure they’ve modeled it out and believe that tighter security drives away customers or some other cost factor that outweighs the cost of fraud. As we always say, if companies don't handle security properly, that could lead to losing their most precious asset: its reputation.


How PayPal could have easily avoided the last account hack

In this tutorial learn how to integrate LDAP and Active Directory (AD) with your C# projects

Using LDAP and Active Directory with C# 101

Learn how to grow your revenue for your SaaS by offering enterprise features like SSO, MFA and Premium Support


For most developers, building for individuals and small to medium-sized businesses (SMBs) fall within their comfort zones, while [selling to the enterprise](https://resources.auth0.com/unlock-b2b-saas-growth-iam/) is something totally foreign that they can’t ever imagine doing.

The problem that you’ll encounter, though, is that churn (the percent of customers who cancel your service) for individuals and SMBs will fall within 3-5% monthly, and that’s if you’re lucky.  Otherwise, you could have churn of 10% monthly or worse, and that means losing X% of your customers every year.  

Just to stand still you’ll need to bring in new customers equal to that number lost.  That’s not easy, and this is the churn problem that ruins companies that target startups, small businesses and individuals.

If you’re experiencing this problem, you’re not alone. There’s actually a very simple solution that could totally change the trajectory of your business—tilt, ever so slightly, upmarket.  Build an “enterprise” version of your product, and you’ll see churn rates drop to 1-2% trending towards the magical “negative churn.”

While it might sound daunting to pull off, it’s actually very simple.  You don’t need to build a sales team.  You don’t need to totally change your product.  All you really need is to do 30 minutes’ work, raise your prices by 2x-5x, and sit back and watch as your revenue grow by 20x.

## Why Tilting Upmarket Will Increase Your Revenue by 20x

Imagine that you have an 100% individual-focused product, and you add the bare minimum features to sell the product for teams at work.  According to Echosign founder and investor [Jason Lemkin](http://saastr.com/), with that single move, you’ll [20x-30x your customer lifetime value](http://www.saastr.com/why-tilting-just-a-smidge-from-self-service-can-grow-your-revenue-30x/).
![](https://images.ctfassets.net/23aumh6u8s0i/2r6hmSbBbwBU8K3s63pYYA/1deb09bd92c3e75d44869220acd4fb49/seats)

You’re increasing the number of seats, but what creates an even bigger multiple for your customer lifetime value is the drop in churn when you go from a customer segment that naturally churns at 3-5% monthly to 1-2%.

What’s more is that your individual or SMB customer won’t add many more seats during its lifetime, because it will start at its natural ceiling, which is the number of people in the company. Enterprise-y customers, however, will add many more seats over time as a result of its massive company size, and that will take your churn from 1-2% down into the realm of negative churn.

What makes this move so profitable is that the bare minimum features to tilt upmarket is probably fewer than you think. That’s because if you see any usage of your individual product at work or you have a product that solves a problem for SMBs, you’ve likely solved a [universal problem](http://www.saastr.com/why-there-is-a-5050-chance-youll-tilt-upmarket-in-saas/) that everyone has at work. The upshot is that you won’t need to add new core functionality.

Plus, if individuals and SMBs are already finding you, enterprise customers will find you soon, too. It’ll start with a small team at a big company finding your first—behaving not unlike an SMB—and then your product will grow into the company from there. Off the bat, you won’t need to build a sales team to sell into the enterprise—they’ll find you.

## How to Go Upmarket By Barely Building Anything

For the enterprise, you’ll of course need to offer more seats and/or more volume based on how the other pricing plans are structured. However, those plans typically scale somewhat linearly in terms of volume. To get that multiplicative bonus above and beyond what a linear scaling of volume would dictate, you’ll need to offer some enterprise-specific features.

These are the features that actually matter to enterprise-level consumers:

1. **Premium support**
2. **Security / Privacy**
3. **Single sign-on**

### Premium Support

Offering premium support is often a matter of assigning an individual on your team to be the account manager for the customer’s account. When you start out, this should be you, the company founder or CEO.  

This may sound like a big hairy problem—keeping an enterprise customer happy—but it turns out that the more a customer pays you, the more they respect you. If you haven’t noticed yet, it’s often the free users that are the most time consuming when it comes to support.

<include src="TweetQuote" quoteText="..the more a customer pays you, the more they respect you."/>

The main thing that premium support should offer is that when a customer does decide to reach out to you, though, you are incredibly responsive in replying and resolving the customer issue.

Premium support is a great way to offer something of value to your enterprise customers, and you don’t need to build a thing to offer it.

<include src="TweetQuote" quoteText="Premium support is a great way to offer something of value to your enterprise customers."/>

![](https://images.ctfassets.net/23aumh6u8s0i/5LxmjITK2J7RFUv00wHjWj/827f3069ba508915ec9e7885e8866b1c/statuspage_20pricing)

[StatusPage.io](http://statuspage.io/) is an example of how a (mostly) bootstrapped company segments its pricing, with its scrappy approach to enterprise plan segmentation.

The markups are significant. from Hobby to Startup is over 3x, from Startup to business is 4x. Adding capacity for more users, better support and some customization allows StatusPage.io to markup their price 13x from Hobby to Business with an unlisted multiple to their enterprise plan (definitely in the thousands if not the tens of thousands per month).

When it comes to support, the ramp up is from email to phone to account rep, and finally, to having the CEO’s phone number. They didn’t have to build a single thing to create that segmentation, but in doing so, they were able to offer just that additional extra enticement to go enterprise.

### Security / Privacy

For some financial companies, law firms or healthcare businesses, they simply can’t use your product unless it has been certified to meet specific security and privacy standards. Auth0 offers [compliance with SOC 2 and HIPAA BAA's](https://auth0.com/security) for these type of customers.

For the majority of companies, there’s a different dynamic happening. If a company wants to buy your product, that typically means that you have an internal champion in the company that wants to buy. The purpose, then, of offering security and privacy features is to help your champion convince the decision maker that you’re not a ragtag startup and that you take security and privacy seriously.

The thing is that you should already be offering much of what’s standard when it comes to security on the web—SSL, data backups, and everything else you get for free by running on Amazon AWS or the like. And that’s going to be available to all of your customers.


![](https://images.ctfassets.net/23aumh6u8s0i/4r3A3noRS7SPjpz9yV0S1b/37481928bb50cd548790babcb3fbcdee/Trello_20Pricing)

Not all individual and business customers want or need [two-factor authentication](https://auth0.com/docs/mfa). But to the security-conscious company, two-factor authentication is extremely valuable. For Trello’s enterprise plan, it’s one of their top 2 selling points.

Trello’s freemium model offers pretty much everything most people need for free. Beyond that, the service offers two more levels: business and enterprise. The main feature jump from free to Business (at $3.75 per user / month) is more control over your users and your boards, along with enhanced security. The Enterprise plan (price unlisted) is for 100+ users. It segments on SSO and 2FA primarily, along with enhanced support.

These days, it’s pretty straightforward to integrate your account management system with a two-factor authentication provider—like Google Authenticator or Duo—and that’s something that we make easy for developers at [Auth0](http://auth0.com/).

![](https://images.ctfassets.net/23aumh6u8s0i/12iEyYoCsrc2YnkDJxJzYG/eb7804222fc949aa20369ca524acac0c/mfa)
### Single Sign-on

Within big companies, managing identity is a huge hassle. Imagine how painful it would be to work at a big company, do your work in 10 different systems, and have to remember a different set of login credentials for each system.

Similarly, imagine that you’re in charge of IT at a big company and you have to provision accounts in 10 different systems each time you make a new hire, and you have to delete accounts in 10 different systems each time you fire someone.

To solve this problem, big companies have enterprise single sign-on, just like normal internet users use Facebook connect or Twitter to manage their logins to different systems. They just have one username and password, and it gets them into all of the systems that they use.

This is a huge selling out for big companies, but it’s nearly irrelevant to individuals, startups and small companies—and that makes it the perfect feature to segment your pricing on.

![](https://images.ctfassets.net/23aumh6u8s0i/6p9tXdnnNWVd6HawUDVQgK/03bbf6507b24477aa88aca874bcdaf7d/slack_20pricing)

Slack is a freemium product, so most users are on the free plan. This gives free marketing to Slack and makes it suitable for a bunch of non-business use cases like family & friends group chat and loosely affiliated professional development groups.

As you go up the price tiers, feature lists do expand which segment companies according to their ability to pay.  Beyond the Standard plan, you have features that only large teams are going to need or want. Single sign-on is the top feature for the Plus plan, which gives it a 2x markup.

In the past, this would’ve been a tough feature to add to your product because it would mean navigating complex protocols like SAML and LDAP, but now you can add SSO to your product in a few minutes with [Auth0](https://auth0.com/). With that one addition you could add an enterprise tier to your service and offer it at 3x, 4x, 5x your basic tier, and 20x your revenue.

![](https://images.ctfassets.net/23aumh6u8s0i/7GGCgjjPNLjiiXA56t5Uit/56b5a3ad22b60ec05705d2b4120e5f85/sso)

## It's not just a theory

We have real examples of our customers being able to increase their pricing thanks to using Auth0.

One of our customers is a big publisher of books and videos. With Auth0, they're now able to sell to enterprise companies and connect to their Active Directories, LDAPs and ADFS so that they can have SSO and charge them more.

Another of our customers is a SaaS for A/B testing. Using Auth0, they can now integrate MFA and SSO with enterprise providers and be able to charge more to their customers because of that.

## It’s Easier Than Ever to Build for the Enterprise

Making big money in the enterprise is easier than ever for developers and startups because of the SaaS infrastructure that’s grown around building for the enterprise.  Your jaw should drop seeing how easy it is to significantly add value to your company by offering upmarket features for enterprise customers.

These aren’t about changing significant parts of your product. They are about offering value to a certain subset of customers. In particular, these people value being able to take ownership of their service.

For 30 minutes’ work.

[Unlock B2B SaaS growth with modern identity management. Download free eBook here.](https://resources.auth0.com/unlock-b2b-saas-growth-iam/)


How to take your SaaS upmarket and grow your revenue by 20x

d48b998c2dce49ca309710eba498c562

Nathan Totten

Remembering usernames and passwords and login urls for all of these apps is a pain. With this app we take another step in simplifying the authentication experience.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Update:</strong> The Single-Sign-On Dashboard referred in this article is now deprecated and has been replaced with the extension that can be found here: <a href="https://auth0.com/docs/extensions/sso-dashboard">Auth0 Extension: Single Sign-On (SSO) Dashboard</a>.
</div>

**tl;dr**: Control which apps your users can access with an SSO dashboard. Download the [code](https://github.com/auth0/auth0-sso-dashboard) or [deploy to Heroku](https://dashboard.heroku.com/new?template=https%3A%2F%2Fgithub.com%2Fauth0%2Fauth0-sso-dashboard) in 5 minutes.

Today, we are excited to announce the release of the Auth0 [Open Source Single-Sign-On Dashboard](https://github.com/auth0/auth0-sso-dashboard). This SSO dashboard is designed to solve a problem familiar to many people. Organizations of all sizes maintain a variety of different applications to handle various business functions like accounting, HR, development, support, etc. Remembering usernames and passwords and login urls for all of these apps is a pain. With this app we take another step in simplifying the authentication experience.

<include src="TweetQuote" quoteText="Today, we are excited to announce the release of the Auth0 Open Source Single-Sign-On Dashboard."/>



![SSO Dashboard](https://images.ctfassets.net/23aumh6u8s0i/52rZ04u2zwgwGtEGzjtim0/4c2a917d6d5fe7fd6a01b84a99e20db0/cfENOYpKxfL_)

You can find the entire source of this project on [Github](https://github.com/auth0/auth0-sso-dashboard) along with instructions on how to deploy and configure a dashboard for your own organization. Additionally, you can try out a demo version (with non-functional apps) at [https://ssodashboard.herokuapp.com](https://ssodashboard.herokuapp.com). Username: `publicdemo` Password: `TestUser123`. This demo only shows the user functionality; if you would like to see the full admin capabilities, please deploy your own instance.

A few key features of the SSO Dashboard:

* Landing page showing all apps that a user is allowed to access.
* Self-service user profile updates.
* Administrator interface for configuring roles, apps, and users.
* Completely customizable UI.

## Completely Open Source
Our approach to this project, like many projects at Auth0, was to build this as an open source app. This approach gives our users the most flexibility while still being very easy to maintain and receive updates.

* Node.js Backend (Express)
* React, Flux, and React-Router
* Bootstrap ([Paper Theme](https://bootswatch.com/paper/)) and [Material UI](http://callemall.github.io/material-ui/#/)
* [Babel](https://babeljs.io/) to enable ES6
* [Webpack](https://webpack.github.io/) for asset bundling

Feel free to fork and clone this project. We will accept pull requests and [issues](https://github.com/auth0/auth0-sso-dashboard/issues) if you want to contribute back.

If this is something you have been looking for at your company or organization do give it a try. Let us know what you think, we will be adding features based on feedback.

"single-sign-on"