Using Auth0’s identity management (IDM) suite feels like a trip to an unfinished furniture store. You have to go in with the expectation that there’ll be a good deal of work to do after your purchase before you have what you really need. The benefits are reduced cost (usually) and more flexibility. But you also need to invest a good deal of time and that’s only if you have the DevOps savvy to accomplish your goals. For these reasons, while it’s a capable choice for those willing to put in the effort, Auth0 stays behind our IDM Editors’ Choice honorees Okta and VMware Workspace One Access.
Getting Started With Auth0
Auth0 connects to directories and existing Identity Providers (IDPs) in much the same way as other IDMs, using a software agent for directories or standard protocols for IDPs such as Active Directory Federation Services (ADFS), Microsoft Azure Active Directory, or Ping Identity‘s PingFederate. The agent’s installation and configuration process is straightforward, so it takes just a few minutes to get your directory connected and available for authentication.
Once the agent installation process is done, you’re directed to a web interface running within the agent where you can configure directory credentials for the agent to use and the profile configuration. The latter is a code-based configuration file that defines what attributes should be available to Auth0, where they should come from, and even how they should be manipulated prior to making it to Auth0.
The profile configuration is ready to use without additional configuration, but if you’ve got the coding chops it’s very flexible for more granular customization. IDPs are also easy to set up, with just a handful of required fields and instructions on where to find the required values. Within each connection to a directory or IDP, you can configure which applications can use the identities it contains. This option can also be managed within the application configuration.
Single Sign-On
The two key pieces with an IDM-based single-sign-on (SSO) setup are the end-user portal and adding applications on the administrative end. Most of the IDM suites we’ve reviewed have both of these functions built-in and fairly well refined, which makes setting up Auth0 a bit awkward by comparison. For starters, Auth0 doesn’t actually have an SSO portal; rather, it’s an extension that you’ll need to install and configure separately.
Compared to the standard-bearers in the IDM space, Auth0’s SSO dashboard is pretty bare-bones. But like everything else about the platform, it packs a lot of functionality and flexibility under the hood. In fact, the SSO dashboard extension is available on GitHub, meaning you can download the source code yourself and tweak it as necessary for your organization.
Adding applications for end-users to authenticate to is a two-step process. First, you add the application in the Auth0 admin console, and then put it on the SSO dashboard. Both steps are rather technical, and Auth0 offers a limited amount of documentation for getting started with specific cloud apps, but there’s a wealth of detail available for developers looking to get their SSO dashboards built out.
Granular Policies and Automation
Auth0 excels at allowing admins to intercept flows within various aspects of authentication, SSO, and identity management in order to build out functionality, enhance security, and improve your IDM solution. In particular, Auth0’s rules facilitate things such as checking an authentication request for the user’s Active Directory group membership, forcing verification via email, or managing a request based on the current time.
Rules also permit updating user profiles by pulling attribute data from various sources, including external applications or connected social networks. Rules use standard JavaScript syntax which is popular, well-documented, and easy to learn. Auth0 provides more than 70 rules out of the box, each of which can be customized or combined to fit your business requirements.
Hooks, like rules, add an immense level of flexibility to Auth0. Triggered by events like password changes or user registration (before or after), hooks enable you to perform a variety of actions such as sending a notification to a Slack channel or email based on whatever logic you implement. For the most part, you’re only limited by the creativity and skill set of your team. While, again, it’s not a point-and-click scenario, Auth0 does offer a number of hooks you can start with and build upon.
A significant percentage of network traffic is malicious, and that fact isn’t changing anytime soon. Between 30% and 40% of the authentication traffic Auth0 ingests is from credential stuffing attacks. These often use known but compromised credentials trying to gain access to secured resources. Auth0 combats this using a variety of methods, the most notable being anomaly detection, which consists of both brute-force and breached-password protection.
Both of these features can be used to not only protect your users, business resources, and ultimately customers by proactively blocking malicious actions, but also to notify users or administrators of attempts so they can take further actions.
Auth0 Pricing
For corporate identity management, your only Auth0 options are the developer plan ($220 monthly for up to 500 employees) or the enterprise tier (call for pricing). Auth0 also offers a free plan for up to 7,000 active users and B2C plans starting at $23 per month, but these expressly support external users.
The Developer Pro pricing level supports up to three enterprise identity providers, an Active Directory connector, enhanced password protection, and MFA options such as Duo or one-time-passwords (OTP) such as Google Authenticator. Enterprise subscribers gain both an SLA and support, as well as support for industry-focused certifications like HIPAA and BAA.
Built for DevOps
There’s no doubt Auth0 is a bit spartan and difficult if you’re really looking to quickly click around a service to get things set up and configured. But from a developer’s perspective, it’s positively lavish. Every aspect of Auth0 management is available via a robust and well-documented API set, making it integral to your DevOps team.
Auth0 also offers extensions facilitating common developer tools and workflows such as GitHub and GitLab, Bitbucket, and Visual Studio Team Services. Each of these extensions is built expressly to enable your team to build out your Auth0 IDM solution as efficiently as possible using the tools they already have and know. Auth0 stands apart from the other IDM solutions we’ve reviewed, but as long as you’ve got coding resources it stands up very well.
