37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Essential practices for securing AI-generated code, key security considerations for your full-stack application, deployment, and infrastructure precautions.

Generate More Secure Code With AI-Powered Tools

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Learn how to Automate your identity infrastructure with the help of Auth0 CLI and Ansible.

Managing infrastructure can be a complex and time-consuming task, especially as your applications and infrastructure grow and evolve. Add identity management to the mix, and you have a whole new set of challenges to deal with. Automating the configuration and management of your Auth0 resources can help streamline the process and ensure consistency across your environments. Command line tools are an invaluable asset for automation and infrastructure management.

[Auth0 CLI](https://auth0.github.io/auth0-cli/) is a powerful command-line tool that allows you to manage your Auth0 resources. You can use Auth0 CLI to create and manage Auth0 resources such as clients, users, roles, actions, and more. Auth0 CLI provides a simple and intuitive interface to interact with your Auth0 account from the terminal, making it easy to automate common tasks and streamline your workflow.

## Getting Started with Auth0 CLI

Install Auth0 CLI by following the instructions in the [official documentation](https://github.com/auth0/auth0-cli/blob/main/README.md#installation).

Once you have installed the tool, run the below command to connect it to your Auth0 tenant.

```shell
auth0 login
```

When prompted, authenticate as a user since you will use this on your local machine.

> If you plan to use the CLI frequently, it might be a good idea to set up command auto completions by following [the official guide](https://auth0.github.io/auth0-cli/auth0_completion.html).

The CLI is now ready to use. Some of the common use cases for the CLI would be;

- Managing Auth0 resources like apps, actions, users, and roles.
- Interact with the [Auth0 Management API](https://auth0.com/docs/api/management/v2) via HTTP requests using the [`auth0 api` command](https://auth0.github.io/auth0-cli/auth0_api.html).
- [Stream tenant logs](https://auth0.github.io/auth0-cli/auth0_logs.html).
- Request access tokens for a particular application and test universal login using the [`auth0 test` command](https://auth0.github.io/auth0-cli/auth0_test.html).
- Generate Terraform configurations for your tenant using the [`auth0 terraform` command](https://auth0.github.io/auth0-cli/auth0_terraform_generate.html).
- Download sample apps using the `auth0 quickstarts` command.

Run `auth0 -h` to see a list of all available commands.

## Why Use Ansible with Auth0 CLI?

When it comes to automation, there are many tools and strategies available, such as Terraform, Ansible, Puppet, Chef, etc. Choosing the right tool depends on the complexity of your infrastructure, your team's specific needs, and the team's expertise. For those who are command-line superheroes and just want simple orchestration of your scripts, Ansible is the perfect choice, as it is ideal for small to medium projects and one-time tasks.

[Ansible](https://www.ansible.com/) is an open-source automation engine that simplifies the deployment and management of applications and infrastructure. Ansible is easy to set up and use. Once set, it gets out of your way so that you can focus on what you do best: writing command line scripts 😸

> If you prefer a model-driven approach or if you want features like state management, long-term configuration management, etc., then Terraform is a better choice

Check out our blog post to get started with Auth0 and Terraform.

<include 
    src="LinkCard" 
    title="Get Started with the Auth0 Terraform Provider" 
    link="https://auth0.com/blog/get-started-with-auth0-terraform-provider/" 
    description="Learn how to get started with the Auth0 Terraform Provider to automate your identity infrastructure." 
    img="https://images.ctfassets.net/23aumh6u8s0i/315vJcTNAjaIgQZWxlovOf/a1839ed3bff28c3da8969642252c86a6/terraform-auth0-logo"
/>

Ansible may not be ideal for complex Auth0 infrastructure setup and management, but if you are a sysadmin or DevOps engineer, Ansible is great for specific use cases like:

- **Orchestrate One-Time Scripts**: If you have a set of one-time scripts that you need to run to configure your Auth0 infrastructure, Ansible is a great choice. You can define your tasks in an Ansible playbook and run them with a single command. These could include setting up Auth0 actions, roles, permissions, etc.
- **Testing**: Ansible is great for testing your Auth0 infrastructure configurations. You can define your infrastructure as code in an Ansible playbook and test it in a controlled environment in a reproducible way.
- **User Onboarding**: If you need to onboard new users to your Auth0 tenant, Ansible can help automate the process. You can define the tasks required to create new users, assign roles, and configure permissions in an Ansible playbook instead of running individual commands.

By combining Auth0 CLI with Ansible, you can automate the configuration of your infrastructure and ensure consistency across your environment without having to meddle with individual commands.

## User Onboarding with Auth0 CLI and Ansible

Install the following tools to get started:

- Install Ansible by referring to the [Ansible installation guide](https://docs.ansible.com/ansible/latest/installation_guide/installation_distros.html).
- Install [jq](https://jqlang.github.io/jq/) for JSON parsing.

Once the tools are installed, log in to your Auth0 tenant with the necessary permissions using the `auth0 login` command. Make sure to select the correct tenant from the dropdown when prompted for granting scopes in the browser.

```shell
auth0 login --scopes create:authentication_methods
```

### Create a new Ansible playbook

Let us create a playbook to onboard a new user to a tenant.

Create a file, e.g., `auth0.yml`, and define the following:

```yaml
- name: Onboard a new user
  hosts: localhost
  vars_prompt:
    - name: tenant
      prompt: 'Set the tenant to use. Leave empty to use default tenant.'
      private: false
    - name: username
      prompt: "What is the user's full name ?"
      private: false
    - name: email
      prompt: "What is the user's email"
      private: false
    - name: default_password
      prompt: 'What is the default password for the user'
  tasks:
    - name: Check mandatory variables are defined
      assert:
        that:
          - username | length > 0
          - email | length > 0
          - default_password | length > 7
    - name: Set tenant
      shell: auth0 tenants use {{ tenant }} --no-input
      when: tenant | length > 0
    - name: Create a user
      shell: auth0 users create --name "{{ username }}" --email {{ email }} --password "{{ default_password }}" --connection-name "Username-Password-Authentication" --json --no-input | jq .user_id
      register: user_output
```

The playbook does the following:

- Defines variables like tenant and username.
- Checks if mandatory variables are set.
- Sets tenant if the value is passed. Otherwise, it uses the default tenant. You can run the `auth0 tenants list` to see all available tenants.
- Creates a new user in the Auth0 tenant.

Let's enable a second-factor authentication for the user. Add the following variable for the phone number to the `vars_prompt` section.

```yaml
- name: phone
  prompt: "What is the user's phone number"
  private: false
```

Add the following task that uses the `auth0 api` command to add SMS OTP as the second-factor authentication for the user.

```yaml
- name: Add SMS OTP 2FA for the user
  shell: |
    auth0 api post \
      "users/{{ user_output.stdout[1:-1] }}/authentication-methods" \
      -d '{"type":"phone","name":"sms_otp","phone_number":"{{ phone }}","preferred_authentication_method":"sms"}'
  when: user_output.stdout is defined and phone | length > 0
```

The task will only be executed if the user is created and a phone number is specified.

Now, let's add commands to assign the user some roles and permissions. Add some new variables for the roles and permissions to the `vars_prompt` section.

```yaml
- name: roles
  prompt: 'What are the comma-separated role IDs to assign to the user?'
  private: false
- name: api_id
  prompt: 'What API do you want to assign to the user?'
  default: https://mydomain.com/api/
  private: false
- name: api_permission
  prompt: 'What API permission do you want to assign to the user?'
  default: read:reports
  private: false
```

Add new tasks to execute the ` auth0 users roles assign` command and add permissions using the `auth0 api` command.

```yaml
- name: Add roles for the user
  shell: auth0 users roles assign {{ user_output.stdout }} --roles "{{ roles }}"
  when: user_output.stdout is defined and roles | length > 0
- name: Add permissions for the user
  shell: |
    auth0 api post \
      "users/{{ user_output.stdout[1:-1] }}/permissions" \
      -d '{"permissions":[{"resource_server_identifier":"{{ api_id }}","permission_name":"{{ api_permission }}"}]}'
  when: user_output.stdout is defined
```

The roles will be assigned only if they are specified during execution, and the permissions will be added only if the user is created.

### Run the Ansible playbook

Once you have defined the tasks in your playbook, you can run it using the `ansible-playbook` command.

```bash
ansible-playbook auth0.yml
```

Ansible will execute the tasks defined in the playbook and automate the onboarding of a new user. You can customize the playbook to include additional tasks like setting up roles, permissions, and other configurations as needed. Look for the console output from Ansible to see the tasks' results. For tasks that use the `auth0 api` command, you can further customize the flow by extracting the HTTP response code and asserting specific codes to handle errors.

## Conclusion

By combining the power of Auth0 CLI and Ansible, you can easily automate the management of your Auth0 resources, saving time and effort in the process. While this is a viable approach for one-time tasks and simple automation, for more complex infrastructure management, you may want to consider using Terraform, which provides more advanced features like state management, long-term configuration management, etc. Auth0 provides native support for Terraform using the [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs).

Happy automating!

## Learn More

I hope that you found this article helpful. Here are some additional resources to learn more about Auth0 and DevOps.

- [Get Started with the Auth0 Terraform Provider](https://auth0.com/blog/get-started-with-auth0-terraform-provider/)
- [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
- [Shhhh... Kubernetes Secrets Are Not Really Secret!](https://auth0.com/blog/kubernetes-secrets-management/)
- [Auth0 CLI Basics - Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)
- [Identity in Spring Boot with Kubernetes, Keycloak, and Auth0](https://auth0.com/blog/identity-in-spring-boot-with-kubernetes-keycloak-and-auth0/)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything about identity and security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@oktadev on Twitter](https://twitter.com/oktadev) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.

Be a Devops Hero! Automate Your Identity Infrastructure with Auth0 CLI and Ansible

bernardo

Bernardo is an Engineering Manager at Auth0 focusing on improving its Performance and Resilience posture. He is a technical leader who is passionate about building quality software that is scalable and resilient to failure, so we can meet the rising expectations of our customers.

Engineering Manager (Performance and Resilience Testing)

Bernardo Guerreiro

How Auth0 uses Performance Engineering to balance infrastructure cost and performance.

Auth0 is providing a world-class service empowering the critical path of millions of logins around the world, so it’s important that we ensure our services are performing well while keeping our infrastructure efficient. The Performance and Resilience Testing team was established in late 2021, as Auth0 made a lot of improvements in its resilience posture. Together with Platform and Product teams, we work toward upholding that performance, reliability, and resilience posture that is such an important pillar of Auth0. 

During 2022, the [development of Auth0’s new Kubernetes-based platform ramped up](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/), which allows for a more repeatable and automated deployment of public and private cloud environments. Since then, our team began a natural partnership with the Platform teams and started working on defining the Private Cloud offerings for our customers. 

One of our key responsibilities has been to define performance tiers for private cloud customers based on different RPS (requests per second) thresholds - 100 RPS, 500 RPS, and 1500 RPS (with more to come). This initiative, called Tier Right-Sizing, is essential to ensuring Auth0 is able to provide our customers with offerings whose infrastructure costs are efficient for their needs, allowing our sales teams to more accurately sell to customers based on their capacity and performance needs. This blog post outlines the process we followed to define these tiers.

## Our Performance Testing Tooling

As you’ll find out as you read the blog post, in order to define these tiers, our team (and many other individuals at Auth0) ran countless performance tests of varying durations. One of the key things our team works on is the tooling and infrastructure for Performance Testing for the whole Engineering organization.

For the last three years, we’ve used [Artillery](https://www.artillery.io/) to run Performance Tests at Auth0, and it has allowed us to scale easily as usage of our framework organically grew within the company. This was important for a few reasons:

- Firstly, because in the last year and a half, the adoption of our framework went from a few people running Performance Tests at Auth0 to almost every engineering team;
- Secondly, because the scope of our tests also grew. For example, in December 2022, as part of the Tier Sizing for a larger customer, we ran 6,000+ RPS tests, which Artillery was able to easily handle thanks to leveraging AWS Fargate’s horizontal scaling.

We’ve also written our own CLI (a wrapper around the Artillery CLI called Airstrike), which has allowed us to standardize Artillery usage across the organization and cater to Auth0-specific use cases. Developers can now run authentication flows they’re familiar with by name, point it at an environment of their choice and simply type a target RPS, all without having to use an Artillery config. This abstracts even further the work of running a Load Test, which is especially helpful for teams that might not be product experts but still need to understand the performance impact of their work, such as platform teams. For example, anyone can run the `authorizationCode` scenario in a specific internal environment at any given RPS, for the duration they need, and with their desired load profile. All they need to do is run this fully configurable command:

```
airstrike run authorizationCodeNew --env tus1 --targetRPS 100 --targetDuration 3600 --loadProfile spike
```

Additionally, the latest Artillery offering, Artillery Dashboard, was also an important part of this Tier Right Sizing effort. Since Airstrike programmatically adds the relevant tags to tests by default, we were able to leverage the dashboard as a centralized location to view all our Performance Test reports for this effort, by filtering by tags to get the relevant test executions. Any load test report is available there for easy historical reference with all its results, logs, and graphs, and we found it easy to consume for stakeholders and developers alike.


![Auth0 Artillery Dashboard](https://images.ctfassets.net/23aumh6u8s0i/1ZpGlYTzV4cNJShIKMk9eq/f1d22eb93f77fe897cd2d75f91cda7bd/auth0-artillery-dashboard.png)


## Tier Right Sizing

My team followed a thorough four-step process which I’ll outline in this section. This process was followed for each of the tiers we’ve defined (5 private cloud tiers total). For all phases, a subset of core authentication scenarios was chosen by our Product team, which represents key product patterns our customers use. 

### Phase 1 - Exploratory Investigations

During this phase, the team worked together with Platform experts on experimenting with several infrastructure sizings and configurations, including:

- Number of resources needed for main services;
- Database Instance Sizes;
- Burstable Instance types;
- Kubernetes Nodes Instance Sizes;
- Kubernetes resource allocation;
- etc.

Since there were a lot of permutations to try, each experiment was only a 10-15 minute load test. This phase can almost be compared to “Exploratory Testing”. Apply an infrastructure change, run a load test, analyze results, rinse and repeat. It gave my team a good sense of the “gotchas” of the new platform, and served to develop an instinct for what would work and what wouldn’t. 

Once the team had arrived at what they believed to be an optimal configuration, it was time to prove that.

### Phase 2 - 1-Hour Baseline Load

This phase was the main acceptance criteria given to us by Product. Once we reached a stable configuration in Phase 1, the intent was to prove that it could hold the Performance SLA for 1 Hour at the defined Max RPS for the tier, for each of the core scenarios (ran sequentially).

If it failed the SLA, it was then necessary to go back to Phase 1 with more experiments until the team narrowed down a working configuration again.

### Phase 3 - 6-Hour Synthetic Load 

The previous phase (1-Hour Baseline Load) gave us confidence in the performance of each individual scenario at peak load, but that’s not always a typical traffic pattern. Realizing this, we decided to borrow from a concept we have in our Staging environments we call “Synthetic Load”, which emulates production-like traffic by running multiple weighted scenarios at the same time. 

For this effort, we added to our existing core scenarios a few more scenarios that customers are likely to have in their environments (Management API, Extensibility, etc.), creating a 6-hour Synthetic Load test, with a total RPS of the Max RPS for the Tier. This gave us confidence that the Tier would perform under more normal production-like conditions, when a lot more services are being hit.

### Phase 4 - 72-Hour Soak Test

The final piece of due diligence was to ensure that we didn’t see a performance impact from any memory leaks, cron jobs, database background operations, etc. For that reason, after consulting with a few experts in the system, we decided to be safe and run long soak tests. These gave us confidence that we wouldn’t see a problem manifest itself over time.

This ended up being a crucial part of the process and actually revealed a few important performance improvements that had to be done in our platform.

### Rollout

After the new tier definitions were live, all new customers used the new tier definitions. However, in a few cases, we had customers already migrated to our new Private Cloud platform, but not yet in our new optimized tiers. In order to guarantee a seamless transition to the newly defined tiers, a dedicated Platform team worked on a release plan. 

All infrastructure changes were gradually rolled out to customers through our [automated release pipeline](https://auth0.com/blog/how-we-do-releases-in-auth0-s-new-private-platform/). Changes were broken down into small batches, and thanks to our automated testing and the soak time built into our release pipeline, Platform teams were able to monitor each change going in to ensure no issues had been introduced, therefore minimizing any risk during this transition. 

## Conclusion

Right Sizing infrastructure is a game of balancing infrastructure cost and performance. There is no right final answer, and while this effort has taken us quite a bit of time, it will likely never be fully done - we will continue to optimize and improve on this over time. In a few cases, we have also had to do this exercise for specific customers with more unique and large-scale use cases (adapting which scenarios were used), so we will be working on generalizing some of these customer patterns.

I want to leave a final note that we were very excited to support this effort on the road to providing a modern platform for our customers. On a personal note, I am incredibly proud of my team for their contributions to this project, from the work in the tooling that eventually supported this effort to the people who directly worked on the project. It’s exciting to take our new platform to higher limits and take on bigger and bigger customers!

Optimizing Cost and Performance of Auth0's Private Cloud

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

Use Pulumi to provision Auth0 resources using your familiar programming languages

Pulumi is a fantastic solution for IaC (Infrastructure as Code). It allows you to manage your cloud services with high-level SDKs for popular programming languages like TypeScript, C#, GoLang, and Python. The familiarity and characteristics of those programming languages make it easier to set up, maintain and write code for your cloud services, including your friendly authentication provider Auth0.

This blog post will show you how to provision Auth0 resources using TypeScript and Pulumi. We will use the Pulumi tool to create and manage our infrastructure as code which is a great way to keep your infrastructure in a safe, version-controlled repository.

Let's get started!

## What Is Pulumi

![Pulumi](https://images.ctfassets.net/23aumh6u8s0i/1B42BPCAgRpINA6tClMT0O/36c34bd180b6eccb98c57b431e028b5e/logo-on-white.png)

Managing your cloud infrastructure can be a daunting task. When even automated, you need to learn a new programming language (or multiple languages) to write code for your cloud services.

Pulumi is a tool that enables developers to write code for their cloud services using familiar programming languages like TypeScript, C#, GoLang, and Python. This makes it easier than ever to get started with Infrastructure as Code.

Pulumi also abstracts away the cloud provider-specific resources and provides a unified view of all your resources in one place. This makes it easy to see what changes need to be made when you want to migrate to a different cloud provider.

## What Is Auth0 and the Auth0 Marketplace

Auth0 is a cloud-based identity and authentication management platform. It provides a platform for developers to add user authentication to their applications and supports a variety of authentication methods, including social login, username and password, and SSO.

The [Auth0 marketplace](https://marketplace.auth0.com) is where developers can find and use pre-built integrations for their applications. These integrations provide user authentication, management, and security features. The Auth0 marketplace offers a variety of integrations, including social login, enterprise federation, and developer tools.

## Setting Up Pulumi with Auth0

For this tutorial, you don't need to have prior knowledge of either Pulumi or Auth0, and we will guide you through the process of signing up, installing, setting up, and seeing your cloud resources created.

### Installing Pulumi

The first step before we start working on our project is to install Pulumi.

Pulumi is easy to install but slightly different on each operating system.

On a Mac, open your terminal, and enter.

```bash
brew install pulumi/tap/pulumi
```

On Linux, similarly, open your terminal, and enter:

```bash
curl -fsSL https://get.pulumi.com | sh
```

On Windows, it does require downloading an installer, so visit their [official installation guide](https://www.pulumi.com/docs/get-started/install/) for more information.

Once installed on any OS, you can verify that it is properly installed by running the following command on your terminal:

```bash
pulumi version
```

If everything is fine, it will output the current Pulumi version at the time of writing `v3.40.1`.

### Signing up for Pulumi

Pulumi is an open-source project and completely free to use; it requires having the Pulumi CLI installed and a backend system where the state and other configurations are installed.

You can set up and run a [self-managed backend instance](https://www.pulumi.com/docs/intro/concepts/state/#logging-into-a-self-managed-backend) or use Pulumi's cloud service, which is [free for individuals and offers several prices for teams and enterprises](https://www.pulumi.com/pricing/).

![Pulumi Sign up screen](https://images.ctfassets.net/23aumh6u8s0i/3KGglqkAt1OvK5Gey6N3au/29e794127f2390baf0aa002540b14a8c/pulumi-signup.png)

Since we want to get started quickly, we will [sign up for a FREE  account](https://app.pulumi.com/signup) using any authentication provider.

After you log in to pulumi.com, go to your terminal and run the following command:

```bash
pulumi login
```

You will see an output like

```bash
Manage your Pulumi stacks by logging in.
Run `pulumi login --help` for alternative login options.
Enter your access token from https://app.pulumi.com/account/tokens
    or hit <ENTER> to log in using your browser                   : 
```

Hit `<Enter>` to log in through your browser, and it's done. Alternatively, you can manually login into https://app.pulumi.com/account/tokens to generate a token and enter it into the CLI.

### Create an Auth0 application for the Pulumi service

Pulumi can manage a lot of the resources of your Auth0 account, but it can't create one for you. Fortunately, that's easy to do. Go ahead and <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a> now.

While on the [Auth0 dashboard](https://manage.auth0.com/dashboard/), navigate to the "Applications" section on the left-side menu.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/5ycVL5iWad2WI70iVG3Y3M/92c626c2ddfcd5bca16f881190ac48f1/auth0-dashboard.png)

Next, the new application dialog appears; enter an application name, e.g., "Pulumi App", and select the "Machine to Machine Applications" type.

![Auth0 new app dialog](https://images.ctfassets.net/23aumh6u8s0i/2ssONixKyuoHY6YgZMdPdi/72fd242d7701892ebeb165f03c5ed088/auth0-create-app.png)

Since we selected the "Machine to Machine" type, we won't need a user for Pulumi; instead, we will use client credentials. But first, we need to authorize the app to access an API, and in our case, we will select the _Auth0 Management API_, which is available by default with your tenant.

![Auth0 authorize machine to machine application dialog](https://images.ctfassets.net/23aumh6u8s0i/0IaEdXG0RMXv7c9CXBrKo/1de4c982417dd75f1811ffef6576ac8a/auth-authorize-app.png)

After selecting the API, the dialog will expand, listing all the permissions available for that API. We recommended that you follow the [principle of least-privilege](https://www.okta.com/identity-101/what-is-least-privilege-access/) and choose the authorizations carefully based on your project requirements, and no more.

With that said, and only because this is a sandbox account, we'll select all to continue, so you are not limited while following this tutorial and dealing with unauthorized access due to missing grants.

### Create a new Pulumi project

We are done with all the platform sign-ups and configurations, and we are ready to start coding.

When working with Pulumi, or any other IaC tool, you'll have to decide if you want to include your Pulumi code alongside your application code or on a separate repository. The steps won't differ, though you may want to name and place directories differently.

To start, let's create a new working directory where we'll place all our Pulumi code:

```bash
mkdir pulumi-auth0-quickstart && cd pulumi-auth0-quickstart
```

Next, we will generate a new project using the Auth0 template:

```bash
pulumi new auth0-typescript
```

> Note that we specified the template name `auth0-typescript`, but there are other languages available. You can read more about Auth0 and Pulumi in the [Auth0 Marketplace](https://marketplace.auth0.com/integrations/pulumi) and the [Pulumi registry docs](https://www.pulumi.com/registry/packages/auth0/).

Once you run the command above, the terminal window will prompt you for a few values:

- Project name: A unique project name.
- Project description: A short description of your project.
- Stack name: typically referred to as the environment or the organization plus the environment, e.g., "dev" or "auth0/dev".
- auth0:clientId: The Auth0 client id for the Pulumi App; we'll go into details on how to get this information next.
- auth0:clientSecret: The Auth0 client secret for the Pulumi App.
- auth0:domain: The Auth0 domain where your Pulumi App is running.

#### How to capture the Auth0 values from my Auth0 account

Heading back to the [Auth0 dashboard](https://manage.auth0.com/dashboard/) and into the recently created application "Pulumi App", you'll see the app overview, then click the _Settings_ tab to access the information we need.

![Auth0 Application Quick Start](https://images.ctfassets.net/23aumh6u8s0i/37CfC12yd0FCOg7lKYWw4F/c25e701c2b6f420836885fa6557e7fba/auth0-app-home.png)

Once on the settings page, the three values we need, clientId, client secret, and domain, are readily available to copy on your screen.

![Auth0 application settings](https://images.ctfassets.net/23aumh6u8s0i/H6CftW0mFWlOYj7VK7pAW/d669e9c327a1ef495e57b95f74ba6da1/auth0-app-settings.png)

Finally, enter those values in the terminal and way for the project to generate. It may take a minute or two, depending on the programming language.

And don't worry about adding your client secret here, it will be only [stored encrypted](https://www.pulumi.com/learn/building-with-pulumi/secrets/), and you can decide the level of control and encryption provider of your choice if necessary.

#### Pulumi and Auth0 quick start project structure

After your project completes, Pulumi will have generated an npm project with three essential files:

- `index.ts`
- `Pulumi.[env].yaml`: Configuration file where all your Auth0 values are stored.
- `Pulumi`: Project related metadata

Let's next take a look at the generated `index.ts` file;

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as auth0 from "@pulumi/auth0";

const client = new auth0.Client("client", {
    allowedLogoutUrls: ["https://www.example.com/logout"],
    allowedOrigins: ["https://www.example.com"],
    callbacks: ["https://example.com/auth/callback"],
    appType: "regular_web",
    jwtConfiguration: {
        alg: "RS256"
    },

})

export const clientId = client.clientId
export const clientSecret = client.clientSecret
```

It is a simple file that will create a new _Auth0 Client_ (or _Auth0 application_), and will set configurations like the application type, logout URLs, callbacks, and allowed origins, all the typical settings you'll need to set up a regular web application.

### Set up the auth0 provider into an existing Pulumi project

If you already have an existing Pulumi project and would like to provision Auth0's resources, you'll first have to install the Auth0 provider for your programming language.

If using typescript, from your terminal, on the root of your Pulumi project, run:

```bash
npm i @pulumi/auth0
```

If you are using other programming languages, check out their official documentation on [how to install the Auth0 provider](https://www.pulumi.com/registry/packages/auth0/installation-configuration/)

After installing the provider, you'll have to configure the Auth0 clientId, client secret, and domain from your "Pulumi App".

To capture the value, check the previous section [How to capture the Auth0 values from my Auth0 Account](#how-to-capture-the-auth0-values-from-my-auth0-account) and, on your terminal, enter the following command with the updated values:

```bash
pulumi config set auth0:domain XXXXXXXXXXXXXX
pulumi config set auth0:client_id YYYYYYYYYYYYYY --secret
pulumi config set auth0:client_secret ZZZZZZZZZZZZZZ --secret
```

Don't forget to use `--secret` for _client_id_ and _client_secret_ as that will tell Pulumi to encrypt the values.

## Running Pulumi and Provisioning the Auth0 Resources

Now we are ready to use Pulumi to provision our Auth0 resources.

On your terminal, run:

```bash
pulumi up
```

Pulumi will first compare the current state (generated by the written code) versus the previously saved state (empty since it is our first execution) and will prepare a plan based on the results.

Here is what it looks like on the terminal:

```text
Previewing update (dev)

View Live: https://app.pulumi.com/bajcmartinez/pulumi-auth0-quickstart/dev/previews/e93bebef-eecf-49ec-a58f-86d0b7ea11db

     Type                   Name                         Plan       
 +   pulumi:pulumi:Stack    pulumi-auth0-quickstart-dev  create     
 +   └─ auth0:index:Client  client                       create     
 
Outputs:
    clientId    : output<string>
    clientSecret: output<string>

Resources:
    + 2 to create

Do you want to perform this update? [Use arrows to move, enter to select, type to filter]
  yes
> no
  details
```

Since it is the first time we run Pulumi for this project, it will create a new Pulumi stack on the backend and will provision the Auth0 application as we defined it in the `index.ts`.

Since we agree with the plan, we proceed to execute by selecting the option `yes` on the screen.

Now Pulumi is creating all the resources and will print the results on the terminal when it finishes.

```text
Updating (dev)

View Live: https://app.pulumi.com/bajcmartinez/pulumi-auth0-quickstart/dev/updates/1

     Type                   Name                         Status      
 +   pulumi:pulumi:Stack    pulumi-auth0-quickstart-dev  created     
 +   └─ auth0:index:Client  client                       created     
 
Outputs:
    clientId    : "ltiZx0e53LJoqr5IpIJrmZHAuwhsj2WZ"
    clientSecret: [secret]

Resources:
    + 2 created

Duration: 7s
```

What would happen if I were to run `pulumi up` again? It should be totally safe, so let's try it and see the results.

```text
Previewing update (dev)

View Live: https://app.pulumi.com/bajcmartinez/pulumi-auth0-quickstart/dev/previews/7fd259e6-cadf-43ab-8b74-3e2329ed818c

     Type                 Name                         Plan     
     pulumi:pulumi:Stack  pulumi-auth0-quickstart-dev           
 
Resources:
    2 unchanged

Do you want to perform this update? [Use arrows to move, enter to select, type to filter]
  yes
> no
  details
```

As expected, Pulumi doesn't detect any changes, the state variable hosted in Pulumi's service and the local configuration given in the code match.

**But what exactly happened in our Auth0 account?** If we go back to the [Auth0 dashboard](https://manage.auth0.com/dashboard/), a new application will appear with the name `client-{unique identifier}`, e.g. `client-8c41df9`. Pulumi, by default, adds that unique identifier at the end of each resource name to prevent name clashing.

![Example of application created with Pulumi in the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/5qA7YmlNDvzg5GIYngXN0b/e906f8c2e552eeb91420c533fce37d31/auth0-provisioned-app.png)

## Use Case Examples for the Pulumi Auth0 SDK
Let's see next some examples of what can be done with the Pulumi Auth0 SDK.

### Provision a new Auth0 application
One of the most common tasks when automating the provisioning of Auth0 resources is to create applications, and as we discussed, we do that by leveraging the [_Client module_](https://www.pulumi.com/registry/packages/auth0/api-docs/client/).

The [official documentation](https://www.pulumi.com/registry/packages/auth0/api-docs/client/) goes into detail on all the parameters and presets for applications, but here is a small sample for a typical scenario for a SPA application (since we already covered web apps):

```typescript
const client = new auth0.Client("my-spa", {
    allowedLogoutUrls: ["https://www.my-spa.com/logout"],
    allowedOrigins: ["https://www.my-spa.com"],
    callbacks: ["https://my-spa.com/auth/callback"],
    appType: "spa",
});
```

### Provision a new Auth0 user
Another typical use case is to create users. This is commonly done for admins, other super users, or even test users.

Let's see an example of creating an _admins_ role and a user belonging to the group.

```typescript
const adminGroup = new auth0.Role("admin", {description: "Administrator"});
const jc = new auth0.User("bajcmartinez", {
    connectionName: "Username-Password-Authentication",
    givenName: "Juan Cruz",
    familyName: "Martinez",
    email: "youremail@yourcompany.com",
    password: "very-secure-!nitial-passw0rd",
    emailVerified: true, // We don't want to email the user to confirm its registration
    roles: [adminGroup.id],
});
```

In the example above, we use the [default database connection](https://auth0.com/docs/authenticate/database-connections) "Username-Password-Authentication". Optionally you can create and use other connections.

> Remember that the user requirements from your connection will apply even when using Pulumi, and if a condition does not match, e.g., "Password is too weak", then the resource will fail to create.

### Set your Branding and personalization with Pulumi and Auth0
Another area where Auth0 excels is personalization, allowing you to personalize the experience with your brand, your colors, logo, messages, email addresses, and even email templates.

You can customize everything about your user's experience through the Auth0 dashboard, but if you are using Pulumi, you can change those parameters through code, thanks to the modules like [Branding](https://www.pulumi.com/registry/packages/auth0/api-docs/branding/), [Email template](https://www.pulumi.com/registry/packages/auth0/api-docs/emailtemplate/), [Prompts](https://www.pulumi.com/registry/packages/auth0/api-docs/promptcustomtext/) and more.

Here is an example of how to change your brand colors and logo using TypeScript:

```typescript
const myBrand = new auth0.Branding("my_brand", {
    colors: {
        pageBackground: "#000000",
        primary: "#0059d6",
    },
    logoUrl: "https://mycompany.org/logo.png",
    universalLogin: {
        body: "<!DOCTYPE html><html><head>{%- auth0:head -%}</head><body>{%- auth0:widget -%}</body></html>",
    },
});
```


### What resources are available with the Pulumi Auth0 integration?
With Pulumi, you can set up pretty much everything you can do with the Auth0 dashboard, so no surprise there are quite a few modules available for us to use, like [Actions](https://www.pulumi.com/registry/packages/auth0/api-docs/action/), [Client Grants](https://www.pulumi.com/registry/packages/auth0/api-docs/clientgrant/), [Attack Protection](https://www.pulumi.com/registry/packages/auth0/api-docs/attackprotection/).

You can read the full list on [Pulumi's official docs](https://www.pulumi.com/registry/packages/auth0/api-docs/).

## Final Thoughts
More and more companies embrace DevOps and infrastructure as code to provision, manage and maintain the ever-increasing complexity of cloud services.

Pulumi helps individuals and teams to handle their IaC strategy through familiar programming languages, reducing the effort and skills needed.

Thanks to its extensibility with libraries, you can provision your servers, databases, queues, and, for example, Auth0 resources to build and customize the online identity experiences of your apps.

Thanks for learning!

Provisioning Auth0 resources with TypeScript and Pulumi

Samuel Frank

Sam Frank is Auth0's Sr. Product Manager for new initiatives. He works within the Auth0 Lab to commercialize the team's new ideas so they're available for builders everywhere. As a former platform product manager and startup product lead, he knows the challenges that developers face when creating new apps and he leverages those experiences to focus our teams efforts delivering the next generation of identity tools.

Senior Product Manager

The Auth0 Marketplace now supports Web3Auth’s innovative key management infrastructure that transforms your app into a dapp

You need a private key to communicate with web3 blockchains; it’s the only way to confirm your own assets on blockchains. However, [Private keys pose a usability challenge](https://csrc.nist.gov/CSRC/media/Presentations/Usability-and-Key-Management/images-media/Usability_and_Key_Mgmt.pdf), and despite being around since the 70s, [they’ve seen poor adoption](https://www.academia.edu/15236280/Overcoming_Barriers_to_Client_Side_Digital_Certificate_Adoption). Web3 wallets, software that stores a private key and creates a communication framework around it, have improved the usability a bit, but it’s still not seamless. Some web3 organizations have tried to solve this problem with [custodial wallets](https://www.coindesk.com/learn/custodial-wallets-vs-non-custodial-crypto-wallets/), where they manage the key for the user. That solution is contrary to the web3 goals of user control and ownership. [Web3Auth’s innovative social authentication tools](https://medium.com/toruslabs/divi-crypto-podcast-key-management-interview-with-zhen-45c418ff3e54) create a non-custodial wallet that the user controls and is still user friendly, and you can now [integrate those tools](https://marketplace.auth0.com/integrations/web3auth) in your Auth0 tenant!

## How Web3Auth is an Advance in Web3 Usability

<img src="https://images.ctfassets.net/23aumh6u8s0i/YpE8R5YzuYRdOAO2DawCI/b64bf3f16f460cad18d3c28c98d468e7/marketplace_01.jpeg" align="right" alt="Web3" width="60%" /> To get access to any blockchain application, a user needs a web3 [public-private key pair](https://en.wikipedia.org/wiki/Public-key_cryptography). The public key functions as the user’s “address” on the blockchain. The address is an ID used to record the ownership of blockchain assets. It can also be used to encrypt messages that only the private key can decrypt. Only the address owner has access to the private key stored in a web3 wallet, which is how blockchains ensure that only the address owner can buy and sell assets associated with the address.

A major usability challenge about keys for the average end user is that if you lose access to it or the private key is exposed; you can’t update it like you would update a password. The most popular web3 wallets typically manage keys by creating a [seed phrase of 12 to 24 words](https://www.coinbase.com/learn/crypto-basics/what-is-a-seed-phrase), which can be used to create an [array of public keys tied to a private key](https://medium.com/toruslabs/a-beginners-guide-the-basic-web3-architecture-and-tech-stack-81f2061d263c). Provided you can find your seed phrase backup, you can recover access to the assets associated with your blockchain address. It's a single point of failure, and expecting users to securely backup their seed phrase does not provide a good user experience. 

[Web3Auth’s platform](https://docs.web3auth.io/overview/key-management) uses [Shamir Secret Sharing](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing) to split the key and save it in the user’s device, a social login provider, and a recovery method. Web3Auth can then look into the device storage and social sign-in to recreate the user’s key, which creates the web2 authentication experience with a non-custodial web3 wallet. If the user is using a new device, they just need to confirm their identity via a recovery option with an email or other method.

This solution provides a developer:

* A non-custodial wallet to use with web3 blockchains.
* An easier way to create user-friendly web3 onboarding in their application.
* The ability to deploy a social login experience associated with a web3 wallet.
* The best of Web3 security and privacy by design for their end-users.

Implementing social logins with Auth0 lets you quickly add a web3 wallet to your existing application. Web3Auth works with a host of blockchains, including the main layer1 chains ([Ethereum](https://ethereum.org/en/), [Solana](https://solana.com/), [Avalanche](https://www.avax.network/)), and layer 2 chains ([Polygon](https://polygon.technology/), [Starkware](https://starkware.co/), [Arbitrum](https://offchainlabs.com/) and more). By the end of the sign-in process, the user has a valid web3 wallet. It’s a frictionless, secure, self-custodial way to onboard users into the web3 world.

## How It Works

Below we have a high-level overview, but if you want the full details, check out the installation guide.

### Regular Web Application Flow

![Regular Web Application Flow](https://images.ctfassets.net/23aumh6u8s0i/71KY5i7OKKpoMa9KhkkRVM/bbfddd66297e51e870e55ef301496e27/marketplace_02.png)

1. A user initiates their sign-in request, which opens the Auth0 login experience. They select their preferred social identity provider.
2. Auth0 manages the OAuth flow, relaying information to the identity provider.
3. The identity provider relays the identity information to Auth0 based on permissions configured in the Auth0 dashboard.
4. Auth0 sends your application server an authorization code as per the normal [authentication flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow).
5. Your server adds a client ID and client secret to request an [ID token](https://auth0.com/docs/secure/tokens) for the user.
6. Your application server sends the ID token to the Web3Auth SDK in the front-end client application.
7. The Web3Auth SDK passes the ID token information to the Web3Auth network, which converts it to a piece of the private key share.
8. The key share is relayed back to the front-end application, which uses it to reconstruct the private key of the user to use in the application.

### Setup Steps

Working knowledge of JavaScript or Mobile SDKs is required depending on your application type. There are four main steps to getting the integration setup. Each of these steps are spelled out in the [integration guide](https://marketplace.auth0.com/integrations/web3auth).

1. Configure your Auth0 tenant and Web3Auth dashboard.
2. Select and install the appropriate Web3Auth SDK based on your application type.
3. With the SDK installed, you’ll need to initialize your Web3Auth application.
4. Finally, you’ll need to use the `connect.to` function to authenticate the user.

## What's Next?

The Auth0Lab team is actively exploring the best ways to enable developers to build applications that rely on Web3 identity constructs and help bridge the Web2 and Web3 worlds. You can follow our progress on [Twitter](https://twitter.com/auth0lab). If you're interested in speaking with the team, join our [Discord](https://discord.gg/xkbkz9rZcD) and start a thread.

The [Auth0 Marketplace](https://marketplace.auth0.com/) is looking for Web3 partners to build new extensions onto Auth0. Visit [https://auth0.com/integrate](https://auth0.com/integrate) to learn more.

Create Non-Custodial Wallets and Lower Web3 Sign-In Friction with Web3Auth’s Auth0 Integration

john-brennan

John is an R&D Content Engineer at Auth0. He has nearly a decade’s experience in full-stack software development in a variety of environments, languages, and frameworks. He relishes the challenge of learning hard-to-grasp technical concepts and helping others understand them in a clear, concise manner. His current technical interests are in API design and scalability, Ruby on Rails, accessibility, single-page app architecture, and the ever-changing JavaScript ecosystem. When he's not working, John is usually cooking, doing creative writing, running, or wrangling a toddler.

R&D Content Engineer

John Brennan

How to use HashiCorp Terraform and the Auth0 Provider to maintain your critical infrastructure, including your Auth0 configuration, in code.

Use HashiCorp Terraform to Manage Your Auth0 Configuration

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to limit the damage during an infrastructure breach


The Capitol riot on January 6 was a dangerous moment on multiple levels, not least of which were the cybersecurity ramifications. The Capitol’s information infrastructure &mdash; laptops, documents, phones &mdash; were all in the hands of rioters for several hours. In one case, a woman allegedly stole a laptop or hard drive from Speaker of the House Nancy Pelosi’s office, though the woman eventually [turned herself in](https://www.nytimes.com/2021/01/18/us/riley-june-williams-emmanuel-jackson.html) to law enforcement.

The potential exposure of sensitive government information &mdash; especially coming on the heels of the devastating [SolarWinds hack](https://auth0.com/blog/the-nine-worst-recent-data-breaches-of-2020/) &mdash; is inspiring business leaders to examine their own cybersecurity vulnerabilities.

Many are asking: What would I do if my company’s tech was lost, stolen, or tampered with? How would we mitigate the damage from compromised hardware?

To start addressing those questions, it’s important to understand how a physical breach (of your offices or of your hardware) can have digital implications. Here are some of the cybersecurity lessons from the Capitol riot and how to protect your company in such an event.

## All Physical Access Is Risky

There’s a famous cybersecurity truism that states, “If a bad actor has physical access to your computer, it’s not your computer anymore.” In other words, just because a mugger hasn’t run off with your laptop, that doesn’t mean it hasn’t been compromised. In the high-stakes world of corporate espionage (not to mention traditional espionage), all an attacker needs is a thumb drive and a moment alone with your device to steal information or introduce malware.

What’s more, in today’s hyperconnected world, computers aren’t the only risk vector since every network-connected device can present an entryway for attackers. The proliferation of devices on which we work has made it much more difficult to assess the damage after a potential security incident. Case in point: In the confusion of the Capitol riot, it was initially unclear how much hardware had been stolen or otherwise compromised. As [Wired](https://www.wired.com/story/capitol-riot-security-congress-trump-mob-clean-up/) reported, “Rioters could have bugged congressional offices, exfiltrated data from unlocked computers, or installed malware on exposed devices.”

### What to do if your hardware may have been breached

Let’s imagine a scenario in which there’s been a break-in at your office. There’s paper scattered everywhere, you’re not sure what devices are missing, and you’re not sure if the remaining tech is compromised. Where do you start damage control?

#### Don’t overreact

Don’t try to physically destroy every piece of hardware that could potentially be infected. That’s like ripping up all your floorboards to locate a single mouse.

#### Focus on securing user identity

The single greatest security threat of 2021 and beyond is a bad actor with stolen credentials. So make sure you’ve implemented [multi-factor authentication](https://auth0.com/learn/get-started-with-mfa/) (MFA), preferably using a strong method like biometric authentication or a hardware token.

In the wake of a breach, you should also change all your passwords. MFA will protect you from a password-based attack, but it isn’t foolproof, especially if an attacker has physical access to session cookies to perform session hijacking. But combining strong MFA, password rotation, and limited session lengths will help purge any bad actors from your system.

In all likelihood, your business will never face a physical breach like the capitol riot. But in the age of [remote work](https://whatfix.com/blog/remote-work-policies/), your organization’s physical assets are constantly in motion and exposed to risk. Given that fact, your network’s true perimeter is built into your networks: user identity.

#### Conduct an asset inventory

Maintain an [asset inventory](https://www.axonius.com/blog/when-asset-inventories-become-incident-response-exercises) of all work-connected devices, and their vulnerability level is breached. Ideally, this is something you will have done prior to a security event, but if not, it should still be a priority. Establishing ownership of each device is a crucial part of asset inventory because without it, tracking down devices is much harder. Have every member of your staff report on the status of their own devices and whether or not they followed security protocols on those devices.

This will let you quickly determine if something is missing and help you figure out where to start looking for intrusions. For example, if Debra from accounting’s laptop is missing, and she had the password taped to it with a sticky note, that’s the first hole you’ll want to patch up.

<NonAmpContent>
<blockquote class="twitter-tweet"><p lang="en" dir="ltr">My heart goes out to the unsung IT heroes at the Capitol tonight. My guess is they've never had to run asset inventory IR before - a daunting, stressful task in a tabletop exercise - and they're running one (prob w/o a playbook) following a full on assault of the Capitol.</p>&mdash; socially distant, mask wearing bat (@mzbat) <a href="https://twitter.com/mzbat/status/1346983709786976257?ref_src=twsrc%5Etfw">January 7, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</NonAmpContent>
<AmpContent>
<amp-twitter
  width="375"
  height="472"
  layout="responsive"
  data-tweetid="1346983709786976257"
>
</amp-twitter>
</AmpContent>

## Enterprises Need Standardized Data Security Policies

Within large organizations, data handling policies can vary from department to department and even from team to team. Some variation is inevitable since people use different devices and different applications and have different data sharing needs. But if your company doesn’t have some shared fundamentals of data security, fixing a breach becomes a daunting task. Large organizations need to establish a shared definition of what sensitive data means to them and what their legal obligations are under [data privacy laws](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/).

One of the biggest challenges in assessing the cybersecurity damage of the Capitol riot is that Congress has no standardized cybersecurity policies. Instead, Senate staffers [told CNN](https://www.cnn.com/2021/01/07/tech/capitol-riots-cybersecurity/index.html) that “while some IT protections exist across the organization, many decisions about information security practices are left up to individual lawmakers’ offices.” They report that some staffers do not use VPNs across all their devices, and some stored data locally on their desktops.

Capitol staffers also don’t seem to have had a shared definition of “sensitive data.” While elected officials are prohibited from sharing classified information outside of specific networks, it sometimes gets out anyway. [Wired](https://www.wired.com/story/capitol-riot-security-congress-trump-mob-clean-up/) reports that “congressional staffers are not subject to Freedom of Information Act obligations and are often much more candid in their communications than other government officials.”

Even seemingly innocuous data can be dangerous in the hands of attackers, who can weaponize a high-ranking official’s (or executive’s) travel schedule. Bad actors can use personal information in spear-phishing attacks. Even device metadata can be extremely revealing if it shows who leaders are communicating with and when. 

Protecting yourself and your company requires developing both technological safeguards and a shared culture of security.

### How to implement tougher data security policies

Improving your organization’s cybersecurity requires C-suite supervision and buy-in at every level. Automate security whenever possible, instead of expecting your workforce to manage it during an emergency when they have other concerns. But while technical protections are crucial, don’t ignore the human element. Strong cybersecurity requires the active participation of an entire workforce and a shared awareness of potential risks.

#### Empower your CISO
Your head of security needs the support and resources necessary to implement top-down guidelines for the whole organization. This should take place in a larger context of the CISO’s evolving role and increasing responsibilities. To quote [Andreessen Horowitz](https://a16z.com/2020/12/18/security-in-2020/): “From its initial focus on securing on-premise servers, the Chief Security Officer (CSO/CISO) role has sprawled to include not just the cloud, but the physical workplace, individual laptops and phones, and data privacy and compliance.”

Part of the CISO’s role is to put security protocols in place so people can focus on their work. The CISO is also responsible for building an internal security culture that makes it easier for humans to choose security best practices whenever possible. Ideally, the rest of the C-Suite strongly supports them in all these efforts and models a commitment to security for the rest of the organization.

#### Have separate devices for work and personal use

This is a real challenge at companies with remote workforces and bring-your-own-device (BYOD) policies, but it’s one of the most effective ways to minimize damage in an attack. To convince your workforce to be disciplined about their device usage, emphasize the privacy benefits to them. 

[Brandon Maxwell](https://auth0.com/blog/authors/brandon-maxwell/), a Detection and Response Manager at Auth0, says, “If your device gets compromised by malware, an incident response engineer is going to have to analyze your downloads, your internet history, all those kinds of things.” In the case of a physical breach, an investigator may inspect the device for company data to ensure it wasn’t modified or accessed. While personal data would not be in scope, the analyst would likely see filenames and other metadata that an end-user may not be comfortable sharing otherwise. Emphasizing both privacy and security helps motivate employees to keep their devices separate.

#### Automate device lockouts

Institute centralized protocols to automatically lock devices after a short period of activity or if the hardware is missing. ([Apple products include this capability](https://support.apple.com/en-us/HT204756) as part of the “Find My” feature.) In an emergency, you can’t expect employees to lock their screens &mdash; it should happen automatically. Yet in the Capitol riots, numerous screens were left open, as you can see in this [deleted tweet](https://www.law.com/therecorder/2021/01/08/will-the-cybersecurity-vulnerabilities-during-capitol-rioting-spur-litigation/) from one of the rioters.

![Elijah Schaffer Tweet](https://images.ctfassets.net/23aumh6u8s0i/RJsOz4VRyoHwF2xznCuQa/6810ff2d9ddfcc741b240a2ae13b043a/elijah-schaffer-tweet)

Just as importantly, [limit session length](https://auth0.com/blog/balance-user-experience-and-security-to-retain-customers/) for employees. Just like your mobile banking app automatically logs you out after a brief period of inactivity, do the same with your sensitive data and applications. This can be useful even if you’re never the victim of an attack since locked devices also protect employees from their kids ordering $100 worth of apps while their back is turned.

You may also want to reconsider checking that “remember me for 30 days” box in your login screens since a bad actor who steals an unlocked or unencrypted device can then easily access that account.

#### Standardize physical, administrative, and technical controls across the organization

Practicing basic cybersecurity hygiene should be as deeply embedded in your company culture as your code of conduct. These expectations include things like requiring all remote workers to use full-tunnel VPNs on all devices. You should also implement strict password policies, guided by current NIST recommendations, and require all employees to use password managers to ensure strong and unique passwords.

#### Assume you’ve already been breached

Adopting this mentality will help you when going through monitoring logs for unauthorized access. Better yet, use an [identity and access management](https://auth0.com/blog/what-is-iam/) (IAM) platform that adopts this mentality on your behalf and proactively demands MFA for users who exhibit suspicious behavior or for employees who use compromised credentials.

## You Can Secure Your Data in a Chaotic World

The U.S. Capitol was put at risk not just by a failure of planning but a failure of imagination: the idea that “it can’t happen here.” Unfortunately, many organizations and businesses have the same attitude about their own cybersecurity, and it puts sensitive data at needless risk. By taking a sober look at the value of your own data and the threats to it, you can start building your defenses in case the unthinkable happens.

To learn more about how centralized identity and access management can be a part of your organization’s security posture, reach out to the team at Auth0.


Cybersecurity Lessons From Capitol Riot

shafiq-shivji

Shafiq leads Product Marketing for Auth0's Ecosystem and Extensibility domains. He brings vast experience from previous roles as a Product Manager and Sales Engineer working in adjacent SaaS industries like machine learning, web/mobile apps, and communications. He especially enjoys the creative process of conceiving and taking high-impact products to market.

Product Marketing Manager

Shafiq Shivji

Identity proofing is a crucial part of your security infrastructure.



## Why Identity Proofing Matters

The total cost of identity fraud reached nearly $17 billion (USD) in 2019, according to [Javelin's 2020 Identity Fraud Survey](https://www.javelinstrategy.com/coverage-area/2020-identity-fraud-study-genesis-identity-fraud-crisis). That cost comes in the form of compromised data, lost resources, and fines under privacy regulations like the [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) in the case of a preventable data breach. Because of these very real risks, the ability to reliably verify a user's identity is a critical component of your security infrastructure.

In many contexts, users self-register to an [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/) system: that is, they sign themselves up. With self-registration, identity verification is often based only on an email address or phone number &mdash; two pieces of information that tell you very little about the user's actual identity in the real world. Especially in certain contexts, it's wise to go beyond email/phone number verification and employ identity proofing services to accurately identify your users.

## What Is Identity Proofing?

**Identity proofing** is the process of verifying a user's identity: confirming that they are who they say they are. This may sound like ordinary authentication, the kind based on a username/password combination, but identity proofing actually comes into play before users get their credentials to access an application or alongside the traditional authentication process. 

Let's consider two definitions put forth by the National Institute of Standards and Technology (NIST) in its [Digital Identity Guidelines](https://pages.nist.gov/800-63-3/):

* **Claimed identity**: Data about the identity a user declares when they register with an IAM system (who they claim to be).
* **Actual identity**: Data proving the authenticity of a user's identity (who they actually are).

The ultimate goal of identity proofing is to ensure that a user's claimed identity matches their actual identity: in other words, that their identity is real and not fictitious. That's why identity proofing is a first-line defense against today's attacks on the identity perimeter.

### The cost of identity fraud

Identity fraud costs individuals and companies a significant amount every year. [According to the Consumer Sentinel Network](https://www.ftc.gov/system/files/documents/reports/consumer-sentinel-network-data-book-2019/consumer_sentinel_network_data_book_2019.pdf), maintained by the US Federal Trade Commission (FTC), 3.2 million identity theft and fraud reports were received by law enforcement and private organizations in 2019. Of these, 1.7 million were fraud-related, while roughly 651,000 (about 20%) were identity theft complaints.

Identity fraud will likely prove even more expensive in 2020: the COVID-19 pandemic, along with social and economic disruption on a global scale, has led to a spike in fraudulent activity. In July 2020, [the FTC warned](https://www.cnbc.com/2020/07/07/covid-19-fraud-has-cost-americans-at-least-77-million.html) that Americans had already lost more than $77 million to fraudulent COVID-19 schemes &mdash; and those are just the reported losses. Actual losses are likely to be significantly higher.

### How Identity Proofing Works

Identity proofing allows you to verify a user's identity based on life history (a credit report), biometrics (a facial scan), and other factors before granting them access to your system.

Of course, you can manually verify your users' identities by requiring them to provide paper documentation (a copy of their passport) or performing an interactive check via online meeting tools like Zoom. As you might expect, these time-consuming manual processes don't scale effectively, and they inevitably detract from your user experience.

In its [Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63a.pdf), the National Institute of Standards and Technology (NIST) defines three crucial steps in the identity proofing process:

1. **Resolution**: Distinguishing a person's identity in the context of the system.
2. **Validation**: Collecting identifying information from the user (username, password, answers to security questions) and confirming the accuracy of that information.
3. **Verification**: Verifying that the user is who they claim to be.

The right identity proofing system can automatically perform this work: gather information about the user, verify whether their claimed identity matches their actual identity, and approve their registration or access request. All of this happens in real time, without human intervention, creating a secure authentication function that doesn't compromise user experience. Investing in identity proofing services allows you to realize these benefits without having to divert resources away from your core competencies. 

### Know where to implement identity proofing

Identity proofing bolsters your security posture by ensuring that your applications trust only verified users. That said, identity proofing isn't necessary or even desirable in every scenario. If the users managed by your IAM system are well-known to you in a business context (for instance, your users are your employees accessing internal systems), you may not need identity proofing.

When it's essential to be sure of user identity across a large user base, identity proofing is critical. For example, identity proofing is necessary to securely onboard patients in telemedicine, register job candidates in an HR system, allow students to sign in for an online exam, and manage online banking and eCommerce transactions. These are all application types that can benefit from identity proofing. 

## Meet the Identity Proofing Experts

[Auth0 Marketplace](https://marketplace.auth0.com/) is an ecosystem of third-party integrations that empower developers to build better identity solutions with superior discovery and installation experiences. You can add identity proofing to your applications with partner integrations from Auth0 Marketplace. Let's take a look at our launch partners who specialize in [identity proofing](https://marketplace.auth0.com/categories/identity-proofing):

### Onfido

[Onfido](https://marketplace.auth0.com/integrations/onfido-identity-verification) uses a photo ID and facial biometrics to verify identity digitally, so users can prove their identity anytime, anywhere. As a digital identity proofing leader, Onfido employs a hybrid approach based on machine learning and human experts to eliminate fraud.

### ID DataWeb

[ID DataWeb](https://marketplace.auth0.com/integrations/iddataweb-identity-verification)'s Attribute Exchange Network (AXN) ties identity verification, multi-factor authentication (MFA), and login services together in a single cloud interface. An easy-to-use dashboard empowers you to create custom verification and authentication policies to establish trust with your users.

### Vouched

[Vouched](https://marketplace.auth0.com/integrations/vouched-id-verification) uses machine learning to guarantee fast, accurate identity verification. With Vouched, companies can instantly verify identity for contractors and customers, gather financial and insurance information, and automate the handling of unverified users.

### Caisson

[Caisson](https://marketplace.auth0.com/integrations/caisson-id-check)'s ID Check integration validates and extracts information from drivers' licenses and passports using machine learning and advanced facial comparison algorithms. ID Check can process hundreds of different photo ID types, and verification typically takes less than 45 seconds.

## Next-Generation Identity Proofing

Identity proofing is a foundational piece of the digital trust relationship you want to establish with your users. Auth0 Marketplace is recruiting the best identity proofing experts to innovate on our platform, so we're ready to help you solve the identity challenges of today and tomorrow — including the challenges that have yet to arise.

<include src="asides/AboutAuth0" />


What Is Identity Proofing and Why Does It Matter?

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

New customer acquisitions channels await if you can walk the tightrope between B2B and B2C.


> Customer acquisition costs can make or break a business. 

The more it costs to acquire a customer, the more value businesses have to get from that customer to make a profit. If the value of each customer is less than the money it takes to acquire them, no investor's wallet will be deep enough to sustain the company for the long term. 

Some companies are turning to other businesses to acquire customers, developing business models that tie mutually beneficial links between the companies and their customers. In this model, called B2B2C, one business offers a service to a business that needs it, but the first business retains the customers it gains. 

Grubhub, a popular delivery app, is an example. When you order your dinner through Grubhub, you can access dozens of restaurants in your local area. You're simultaneously the customer of Grubhub and whichever restaurant you choose. GrubHub didn't sell their product to the restaurant (B2B), nor did they make the food you're about to eat (B2C). This is the B2B2C business model in action. 

B2B2C offers a compelling mix of B2B and B2C advantages to startups searching for product-market fit and to established companies looking to acquire new customers. When done right, it's win-win-win for both of the businesses and their customers. 

## What is B2B2C?

B2B2C describes a business model where your company sells a product or service to another business, which gets you access to customers you get to keep and use. Here are the key differentiators for B2B2C:

1. Your business offers a horizontal solution to another business's problem.
2. The other business's customers recognize that they're also your customers.

![Image of Business to business to consumer acronym (B2B2C)](https://images.ctfassets.net/23aumh6u8s0i/u2b5DKGwQGoT0HFSNvDwq/50d62116826610c3c7734a26a9903c40/b2b2c-separator-01.png)

Take another look at Grubhub: It sells a horizontal feature to the restaurants around you. Many of them can't offer delivery, and most of them don't have the funds to build out a consumer-facing app—much less provide customer support for it. 

If a restaurant partners with Grubhub, they get to offer their previous customers a new feature, potentially resulting in more orders and higher customer satisfaction. When Grubhub partners with a restaurant, they get access to those customers and can maintain that relationship as they order from other restaurants in other locations. 

The B2B2C model is more than a mutually beneficial relationship between businesses: It requires that customers develop direct but separable relationships with both brands.  

Your local grocery store didn't form a B2B2C relationship with Coca-Cola to sell soda. This is a vendor relationship: Coca-Cola sells their product at wholesale to another business, which sells it to you for a marked-up price; Coca-Cola doesn't sell soda to you directly. 

Another easy-to-mix-up B2B relationship is white labeling. Take [Bread, for example](https://www.getbread.com/blog/truth-about-white-labeling/). Bread offers a white-labeled product for stores that want to offer financing. You might notice a horizontal value here. But the nature of a white-label relationship is that customers don't know they're using Bread; they just know there's a new button when they check out.  

In a true B2B2C deal, the business you're selling to gets a problem solved, and your business gets access to a new customer base that isn't fixed to the prior business. 

## Why B2B2C Can Create Strategic Customer Growth

B2B2C deals combine two of the best features from B2C and B2B models: network effects and predictable growth plans. 

If you acquire entire customer bases through B2B2C deals, you can use that data to fuel further acquisition and iteration. The more you know about your customers, the better you can find them and serve them. 

Network effects are typically the domain of B2C companies — Facebook and Google being [prime examples](https://stratechery.com/2018/the-moat-map/). Unfortunately for other B2C companies, network effects have discouraging, downstream influences. Google's product improves as it acquires users, which means that any Google competitors have to find ways to improve their product without the same access to feedback. 

With a B2B2C model, you can get around some of those effects. Each B2B2C deal offers you customers and data, but you can build on those network effects in chunks rather than drips. With this kind of acquisition, you can plan for network effects. 

OpenTable, a B2B2C company that offers online reservations with restaurants, builds network effects into its email marketing. Initial user acquisition typically starts with users seeking a reservation to a local restaurant, but once users join the service, they get restaurant recommendations tailored to them based on users in their area. 

![OpenTable web site screenshot](https://images.ctfassets.net/23aumh6u8s0i/4UXoeaHxiRqDirf84Nx5Xm/7759092d29a0a3794befa9da5ea8e1f7/open-table)

With network effects providing a tailwind, OpenTable's horizontal service shows users that they're now OpenTable customers and that there's value in being an active participant in the service.  

By making deals with businesses instead of navigating waves of consumer trends, you can also make a more predictable, long-term growth plan. 

Hero, another company with a B2B2C business model, has this planning potential. Hero enables retail employees in physical stores to connect with online shoppers through chat and live video. 

![Hero live from showroom application](https://images.ctfassets.net/23aumh6u8s0i/2GtFDECEq6H2GISKqnJ3x7/a4acaa4798fc466e589d33721715eaf6/hero-showroom)
*[Source](https://blog.usehero.com/selling-iconic-designs-online-how-jonathan-adler-maximizes-its-stores-potential-with-hero-e344f5c94694)*

Hero provides a digital layer for physical retailers. That way, physical retailers can still interact with online consumers by showing them products and sharing information.

Instead of acquiring users directly, Hero can chart its growth against a much smaller selection of stores and chains. 

This growth plan is advantageous because B2B companies [tend to have less churn](https://www.profitwell.com/blog/how-b2b-and-b2c-companies-solve-churn-for-different-customers) than B2C companies. Consumers have a wide variety of services to turn to, and might churn because they lose interest, find a better product, or decide they could no longer afford it. B2B companies try to solve business problems, so client interest isn't as likely to wane and there might not be many alternatives if the market is niche. 

With B2B sales, you can focus on building a sales team that pursues and maintains fewer, but larger,  accounts. As each B2B client offers a group of customers, you can still [get the data](https://auth0.com/blog/three-tools-to-improve-your-customer-intelligence/) that cultivates successful B2C growth. 

A B2B2C company can iterate its service with each customer but plan its growth with each client. 

## B2B2C Customers Need Identity Infrastructure

B2B2C business models rely on an infrastructure that enables cross-platform user management. With white-labeled [identity infrastructure](https://auth0.com/blog/what-is-identity-infrastructure/) from Auth0, you can make authentication seamless and secure so that customers can focus on using and enjoying your product.

### Single Sign On (SSO)

Asking users to remember another set of credentials is a big request. According to a Digital Guardian survey, [nearly a third of users](https://digitalguardian.com/blog/uncovering-password-habits-are-users-password-security-habits-improving-infographic) already have too many password-protected credentials to count. If they're trying your service out for the first time, you don’t want to create friction.

Look at the identity needs of a [company like GO1](https://auth0.com/learn/go1-adaptable-authentication-service-built-scale/), for instance. GO1 is a B2B2C company that works with learning management system providers to build a repository of compliance and professional development content. With one subscription, end-users get access to this volume of valuable content, and businesses can better enable employee growth. 

Seamless authentication is key for this level of engagement. Self-development isn’t always easy, and users facing a login screen every time they want to view a resource or test a new module could make the experience even harder. GO1’s long-term success rests on consistently showing users the value of new knowledge and making it simple for them to pursue it.

![The Go1 Site screenshot](https://images.ctfassets.net/23aumh6u8s0i/453YMGqqDX01MzeD1ETKmR/0aec12fee74f33cd95e9f24fc5f971a7/go1-site)

[Single Sign On (SSO)](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/) enables users to log in with one set of credentials — and stay logged in — creating a seamless experience that lets the GO1 product shine through. 

As GO1 expands to new use cases, such as enabling job search companies to prompt their applicants to complete training via GO1 before applying, the authentication experience becomes even more important. Expansion requires integrating with different authentication protocols, such as SAML and LDAP. An outsourced identity provider can help you consistently [scale a high-level authentication experience](https://auth0.com/blog/the-real-roi-of-auth0-part-2-innovation/) without consuming your developer resources. 

### Security and Privacy

A B2B2C business model also relies on the ability to safely manage users. 

If you want to sell another business on your service, the advantages of that deal need to outweigh the risk associated with introducing a third party. The network effects that make a B2B2C deal valuable depend on data, so your customers need to be able to trust you with that data. 

Since B2B2C typically involves one business positioning its service as an add-on to another business's service, a [data breach](https://auth0.com/blog/what-is-a-data-breach/) can be especially dangerous. Users are already getting value from the main service, so if your security practices develop a poor reputation, you'll be easy to avoid. And if the [data breach is high profile](https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/), the main business might drop your service to keep its users safe. 

Auth0 is a trusted, vetted identity provider, as proven by our adherence to best-in-class [compliance frameworks](https://auth0.com/security/). By offering robust security features, you can demonstrate to users, and the business offering them to you, that you can treat their data with care. 

Counterintuitively, adding security also grants you the opportunity to learn more about your users. Auth0 offers [progressive profiling tools](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) so that you can learn more about your customers over time. Rather than barrage them with questions all at once, you can get different bits of information every time they log in: their name the first time, their address the second, their industry the third, and so on. 

Security can bolster, not slow down, your network effects. 

### Branding and White Labeling 

An essential feature of a successful B2B2C relationship is that your newly acquired customers actually identify as your customers. If your brand name merely flashes by as customers proceed with their normal flows, then you're not getting the full value of the B2B2C deal. 

The B2B2C relationship is already fairly complex, and customers are liable to confuse which business they need to contact for support in different contexts. If you can white label any of the supporting infrastructures you need to manage users, your relationship with them will be simpler. 

With Auth0's [Guardian](https://auth0.com/multifactor-authentication), you can build a multi-factor authentication application that matches your brand's look and feel. Combined with an extensive JavaScript library, you can further customize Guardian to your specific needs. 

Branding is powerful, and with the right tools, your customers are better able to see your service and remember its value. 

## Is Your Business Right for B2B2C?

B2B2C relies on aligned incentives and on businesses that can maintain that alignment. 

The business you're selling to has to want another brand involved, not just your service or solution. If that business only wants a new feature, a true B2B2C deal will be difficult to strike and hard to maintain. 

Look for these deals by pursuing companies that already offer a range of services or products. They'll likely be more open to adding yours to their portfolio. If you come into the deal with a well-run customer success team, you can [pitch that support](https://blog.getbase.com/sales-support-drive-acquisition). The less that business has to worry about the problems your solution might introduce for their customers, the better.  

B2B2C can be your core business model, or it can be a growth stage. Uber started as a digital, on-demand cab service; now it offers delivery at scale through Uber Eats. Instacart started as a grocery delivery service, but there's speculation it might [pivot to B2C](https://www.forbes.com/sites/brittainladd/2019/02/11/killing-instacart-why-the-company-is-at-risk-of-crashing-to-the-ground/#551d52d536e8) by leveraging user data to open its own grocery stores. 

To strike a B2B2C deal, your service has to offer horizontal value. To succeed with a B2B2C deal, new users have to identify as your customers. 

Getting the deal depends on a good sales team and the right product alignment. Succeeding with the deal depends on supporting users with the right identity infrastructure and the best authentication experience.  

<include src="asides/AboutAuth0" />


B2B2C Customer Acquisition Needs Identity Infrastructure

Enable your upmarket strategy with the right technical infrastructure



Enterprise customers are demanding.

Long sales cycles, filled with requests for custom features and integrations, can monopolize your developers and your sales team. If a contract falls through, a lot of time and money will fall through with it.

But the [_move upmarket_](https://auth0.com/blog/how-to-go-upmarket-and-grow-your-revenue-by-20x/) doesn't need to be such a struggle. If you're willing to slightly alter your sales strategy, you can quickly impress new clients and close enterprise deals.

Enterprise clients present three primary challenges to growing B2B companies:

1. **Legacy technology stacks**: Enterprises prioritize stability and often favor products from companies that have long histories in their industries.
2. **Intensive security demands**: Enterprises handle large volumes of data that make security breaches especially risky.
3. **Unique needs**: Enterprises have numerous stakeholders who need to be satisfied, some of whom will demand simplicity and others customization.

With Auth0's [_B2B federation_](https://auth0.com/b2b-enterprise-identity-management/), you can shorten the sales cycle with compatible infrastructure, ensure that the connections between your product and their employees are secure, and address their unique needs with custom configurations.

![Auth0 helps B2B companies grow](https://images.ctfassets.net/23aumh6u8s0i/76cbcjek9FIZY6nxQmvdZR/f0a096097a955ecfb53f099394e91092/b2b_1)

## Offer Compatibility Options to Shorten Your Sales Cycles with Enterprise Customers

The bigger an organization gets, the more internal and third-party tools — all potentially built on different stacks with different protocols — are likely to be in use. The person you're initially selling to might not even know all the infrastructure complications lying in wait.

A primary example is identity and access management (IAM) providers. Your ability to integrate with whichever provider your customers use can drastically shorten or lengthen the sales cycle. If they use Active Directory (and _[hundreds of thousands do](https://auth0.com/blog/analysis-of-enterprise-connections-data/)_), you'll need to implement that before you can close the deal.

If you let the sales cycle stretch out (already _[estimated at 3-6 months](https://saasmetrics.co/benchmark-for-b2b-saas-sales-cycles/)_ for deals that exceed \$100,000 in annual contract value), your internal advocate might move to a different position or company, or the benefits of your initial pitch might not remain relevant. Meanwhile, you might be losing out on other opportunities as you pay expensive developers to make your back end work with theirs.

Worse, if your next customer has a different back end, you'll have to do it all over again.

Auth0 offers B2B federation that _[integrates with 10+ IAM providers](https://auth0.com/blog/how-enterprise-federation-helps-shorten-the-sales-cycle/)_. With a few lines of code, you can configure any enterprise connection, including Active Directory, LDAP, ADFS, SAML, and more.

![Auth0 enterprise connections](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation provides the technical compatibility that makes your product more trustworthy and easier to use. By configuring your app with Auth0, you effectively configure it for numerous providers at once.

A sustainable [_enterprise sales strategy_](https://sapphireventures.com/oiling-the-enterprise-it-sales-engine/) builds from one company to the next, so you don't need to start over each time.

<include src="TweetQuote" quoteText="Auth0 offers B2B federation that integrates with 10+ IAM providers. Active Directory, LDAP, ADFS, SAML? Bring it on!"/>

## Show Enterprise Customers They Can Trust You

High-profile [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) have made enterprises increasingly risk-averse. To a wary enterprise, another partnership might seem like another vulnerability. New products, though they might be valuable, risk widening an enterprise's attack surface.

Enterprises are more likely than SMBs to have security and compliance teams that will take a critical look at your product. These teams need more than assurance. Their input for your service-level agreements will go beyond up-times and scalability and into strict security parameters and compliance standards.

If you provide federation through Auth0, however, maintaining security and compliance in the authentication process is much easier. Auth0 combines the simplicity of a federated identity provider with customizable security features. Your customers can enable tools like multi-factor authentication (MFA) and reinforce compliance procedures as necessary.

![Auth0 multi-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/5zHCdntb8UHVwFG6QBnhd4/2b9f2ba4cfbcab1461b35f82e76d4e8c/why-federation-is-your-secret-weapon-for-enterprise_auth0-multi-factor-authentication)

With MFA, your enterprise clients know that access to sensitive materials won't be granted to anyone with a username and password. Despite these barriers to malicious access, administrators can approve requests easily across a variety of devices.

Guardian, Auth0's MFA application, also provides Mobile SDKs for [_iOS_](https://auth0.com/docs/multifactor-authentication/developer/libraries/ios) and [_Android_](https://auth0.com/docs/multifactor-authentication/developer/libraries/android) that enable you to build a white-labeled MFA application that matches a customer's branding.

Auth0 is compliant with a [_wide range of security, privacy, and compliance standards_](https://auth0.com/security/), such as HIPAA BAA, SOC 2 Type II, and PCI DSS, so you can demonstrate an understanding of your customer's industry-specific needs.

If you're competing with other products that have similar value propositions, the trust you build with enterprise customers can tip a decision in your favor. With Auth0 backing you, it's easier to address concerns from security and compliance teams. The faster and better you can satisfy these stakeholders, the closer you can get to completing a deal.

<include src="TweetQuote" quoteText="Auth0 is compliant with a wide range of security, privacy, and compliance standards such as HIPAA BAA, SOC 2 Type II, and PCI DSS that lets you cover your customer's industry-specific needs."/>

## Sell across Organizations with Single Sign on and Customization

Selling to an enterprise requires selling across levels and [_pleasing different parties_](https://www.copper.com/blog/enterprise-sales-prospecting). Your point of contact might be excited by the core value proposition, but the project managers might be worried about its execution. If all decision-makers aren't in agreement, a deal months in the making can fall apart.

Authentication can be a significant hurdle. IT staff, for example, might resist a new product if it threatens to increase their account-management workloads. Other stakeholders might resist the sheer addition of more credentials to memorize.

Single sign-on (SSO) can dispatch these concerns. With Auth0, employees will only have to enter their credentials once.

![Auth0 single sign-on](https://images.ctfassets.net/23aumh6u8s0i/51MTEF6y286lEpPFiuWMMC/5b67cb0f5643bb655fe06ddf981240cc/why-federation-is-your-secret-weapon-for-enterprise_auth0-single-sign-on)

Enterprises have a higher volume of users and tools, so the ability to sign on once is compelling.

Safari, a company that provides access for corporate learning materials, [_leveraged Auth0's SSO capabilities_](https://auth0.com/learn/safari-case-study/) to expand to enterprise customers. SSO cut support calls for account management without Safari having to dedicate specialized resources. They have since added numerous enterprise customers, differentiating their offering with easy authentication across desktop and mobile devices.

If you need to make integration and usage even smoother, Auth0 also provides customizable _[Rules](https://auth0.com/docs/rules)_. With this customization engine, you can make unique authentication and authorization stages for the customers that need it.

You can use Rules to assist migration by reusing information from existing databases, maintain a white list for particular users, notify systems of login attempts, and more.

## Moving Upmarket Requires a Renewed Strategy

Moving upmarket is more complicated than aiming your sales team at a different target. While you might be able to [_validate product/market fit_](https://www.intercom.com/blog/podcasts/the-myths-of-product-market-fit/) with smaller companies first, moving to enterprise clients requires significant planning.

Moving too fast can threaten your stability. A big contract might seem like a win at first, but without a [diverse customer base](https://www.inc.com/magazine/201606/jason-fried/saying-no-to-large-enterprise-customers.html), too much of your sustainability might hinge on a single large customer. If you shift your business to serve only a few clients, then your future belongs to those contracts—and that's a position no one wants to be in.

Closing deals with enterprise customers means closing the gap between a legacy provider's track record and your ability to meet the needs of your customer. The better you can tailor your product to their needs, the more you'll be able to _[shorten the sales cycle](https://blog.getbase.com/3-hurdles-slowing-sales-cycle)_ and build more valuable relationships for the long-run.

<include src="asides/AboutAuth0" />


Why Federation Is Your Secret Weapon for Enterprise

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

It's not magic. Startups can succeed if they have infrastructure that enables them to scale quickly and securely.


Unicorns (startups valued at over $1 billion) depend on rapid, uninterrupted growth. With just a [1.28% chance](https://www.cbinsights.com/research/unicorn-conversion-rate/) of achieving this coveted status, you need to set yourself up for success from the very start.

Your growth begins with creating infrastructure that fits your needs. To realize your vision for the impact you want to have on the world, you need to assemble systems that enable speed and efficiency — and can also rapidly adapt to change.

It's no easy feat. [Forbes](https://www.forbes.com/next-billion-dollar-startups/#56e3d2514441) believes Auth0 might be figuring it out. We wanted to share some of the insights and advice gleaned from our journey. While there's no one-size-fits-all solution, this piece offers entrepreneurs and their early technical teams advice on when to build or buy their tools, how to become a leader in customer engagement, and how to effectively manage a growing number of users as you scale. 

Nailing these critical components of growth early on will provide a solid foundation from which to take off.

## When Should You Buy, and When Should You Build?

As you grow, you'll need ways to store data, collaborate with co-workers ([particularly remote ones](https://auth0.com/blog/we-are-thankful-for-these-benefits-of-working-remote/)), and understand and connect with your customers. You’ll also need systems for [managing your finances](https://pilot.com/blog/merakis-hans-robertson-on-building-a-startup-finance-team/), hiring and human resources, and, of course, [security](https://auth0.com/security/). 

When confronting these challenges, teams at early-stage companies face trade-offs between [building or buying their own tools](https://auth0.com/blog/when-to-build-and-when-to-buy/).

![Startup Unicorn in the build vs buy tools/tech analysis.](https://images.ctfassets.net/23aumh6u8s0i/1wwxoR3yvEUhr4CBpXZ2UA/b7ae38df1cf649e93a5b91021a3833fa/the-build-vs-buy-analysis)

On the one hand, built tools have the potential to fit your specific use case and needs. If you create them in-house, your developers will have an intimate view of your team's mindset and working style. Though it might be time-consuming, building your systems fully on your own might pay off in the long run as you’re not incurring third-party fees.

On the other hand, when you're in the midst of rapid growth, [buying can be faster to implement](https://auth0.com/blog/auth0-roi-how-are-you-calculating-your-build-formula/). The upfront cost might be a challenge, but you won’t tie up your tech talent for months on end and can begin using your tools for faster ROI.

An approach that many startups take is to build certain components in-house and find trustworthy partners that understand their business and need for flexible solutions to fill in critical gaps.

Here at Auth0, for instance, we offer a [“buy and customize” model](https://auth0.com/learn/identity-faster-buy-customize/) for our identity solutions that can immediately address core issues like federation and offer teams the ability to refine other processes like user authentication. 

Auth0 Extensions enable third-party integrations that extend Auth0's base identity product. With Extensions, you can authorize users with groups, roles, and permissions; manage custom social connections; import and export existing users; create a single sign-on dashboard; and more.

The ability to [customize and integrate](https://auth0.com/docs/integrations) can help reduce business risk and close sales. 

As you grow and take on new [enterprise level clients](https://auth0.com/enterprise), striking the right balance of powerful and flexible tools becomes even more valuable — helping you to meet, and even exceed, demands of increasingly complex service-level agreements.

## Unicorns are Always on the Front Lines of Customer Engagement

Before long, you'll have too many customers to reliably speak to or survey. The importance of [feedback, metrics, and iteration](https://www.profitwell.com/blog/choosing-the-right-saas-metrics-for-different-stages-of-your-company) will require sophisticated analytics tools that can capture granular user data. 

![Startup Unicorn analyzing customer data in their decision-making](https://images.ctfassets.net/23aumh6u8s0i/m8HYvKo8fo1kVSN6go1wA/ab8df220f045c43ace7f96ab0cc8611d/analyzing-customer-data-is-key)

Infrastructure that enables [social login](https://auth0.com/learn/social-login/) can provide a stage for these analytics. Every time a user authenticates to your site, you can learn more about who they are and what they want — all while making it easier for them to log in. 
Social logins [reduce friction](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth//) so that users don't have to create new accounts to join your site. Less friction can result in lower customer acquisition costs, maximizing the value of your marketing efforts.

With social login, you can correlate [users' logins](https://auth0.com/docs/identityproviders) with other data, such as pages visited and shopping cart additions. You can even do [sentiment analyses](https://auth0.com/blog/4-ways-to-calculate-your-customers-happiness/) that search their login source, such as Twitter, for positive or negative mentions of your company. 

The sooner you know more information about someone, the better you can [personalize the onboarding experience](https://blog.clearbit.com/customized-saas-on-boarding-actions-person-role-referring-link/) and support retention down the line. 

In addition, Auth0 enables [progressive profiling](https://auth0.com/blog/progressive-profiling/), which builds up an image of each user as they interact with your product. Users authenticated through Auth0 each get a profile, which fills in with information from their identity provider, attributes created by [_Rules_](https://auth0.com/docs/rules), and information directly from users.

## Unicorns Always Efficiently Manage Their Users

This rapid model of change means that startups are constantly under pressure to spend resources on improving their core product. Speed must, however, match security. The more you grow, the more vulnerabilities you're likely to have, and the better target you become for hackers. 

Over half of SMB breaches result from [negligent employees or contractors](https://keepersecurity.com/assets/pdf/Keeper-2017-Ponemon-Report.pdf), but you can mitigate these threats by authorizing different levels of access for different people working to improve your products.

Identity is one of those areas that might seem like an afterthought; however, it becomes essential as your company grows. Authenticating new employees while you let go of others, and tracking all of your temporary contractors, consultants, and partners can become so complex that it drains technical resources from core product development. Losing sight of this, however, can result in gaps in communication, project delays, and even [data breaches](https://auth0.com/blog/what-is-a-data-breach/).

Outsourcing your identity needs is one way that many teams remain focused on their core business while easily and securely [managing different levels of access](https://auth0.com/user-management).

Auth0 profiles enable you to see detailed information on each of your users, such as authentication details, devices, login histories, and locations. With a comprehensive user management dashboard, authenticating users won't slow you down. 

Managing users on your own will cost you time, but a security breach can cost you your company. If growth is your goal, then defense and recovery need to be as important as your offense.

## You Want to be a Unicorn? Make Innovation + Infrastructure Work Together

Methods that made your company successful in its first year might not work in its fifth. If you want to be a unicorn company, your growth depends on flexible and powerful infrastructure that directly supports your [bold startup vision](https://www.intercom.com/blog/why-startups-need-a-strong-vision/) — even as it changes over time.

![Startup Unicorn innovating and growing thanks to powerful infrastructure](https://images.ctfassets.net/23aumh6u8s0i/4hSxXMHqxWgOdSTyUs57G1/f2e706df4f7956e9b6506681ac1e76ec/innovation-and-infrastructure-supports-growth)

No one can guarantee your success; however, finding the right balance of partners and tools to support you *will significantly increase your chances*.

<include src="asides/AboutAuth0" />



So You Want to be a Unicorn?

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

Kapehe Jorgenson

Platform Engineer Dorrin Poorkay on the challenge of scaling and the benefits of calm leadership



Platform Engineer [Dorrin Poorkay](https://www.linkedin.com/in/dorrin-poorkay-94552b82/) came to [Auth0](https://auth0.com/) after working as an infrastructure engineer for a local startup facing rapid growth where she handled [Amazon Web Services (AWS)](https://aws.amazon.com/) infrastructure. She also maintained the cloud infrastructure (OpenStack) at the [University of Louisville](http://louisville.edu/), where she also earned her degree in computer science and engineering.

Sitting down with Dorrin was not your typical "let's meet in a conference room" because Auth0's a globally distributed company. We kept in touch via Slack, Google Docs, and Zoom. I learned more about her path to Auth0, what it’s really like to be a platform engineer, and her favorite programming language — all while being on the other side of the United States from each other.

![Photo of Dorrin Poorkay](https://images.ctfassets.net/23aumh6u8s0i/chaGa7c9KKM8i2ZOja0i2/6a6360c8eee3f36061e8a1c6cccb186e/dorrin-poorkay-2)

**On the daily life of a platform engineer at Auth0:**

Platform engineers design and build the underlying infrastructure for applications to run on. Given that we’re responsible for the foundation of our entire product, a lot goes on in a typical day of platform engineers.

Some days I'm on-call and responding to incidents — those days are chaotic, but fun! Other days I work on building new infrastructure, automating our current one, and making improvements.

I always start my day with coffee and aim to be productive right from the start. Over the years, I’ve found I’m most productive after my first cup of coffee and again late at night. I try to structure my day by scheduling meetings during my "downtime" (when I’m least productive) and snoozing Slack and my phone to minimize distractions.

During my on-call week, things are a bit different as I have to be alert and respond to pages quickly, but I adjust by planning for the interruption beforehand and setting expectations. When I am on-call, each day is unique. The flow of my day depends on what happens. Sometimes you wake up at 3:00 a.m. to a page. Most of the time our incidents are short but if incidents are long (say a few hours) then your teammates will fill in for you to get some rest and sleep. It balances out nicely. While most of our incidents do not mean “widespread outage”, we proactively monitor all of our systems and can be paged preemptively before our customers can experience issues.

Whether on-call or not, a light lunch and an hour of exercise are also included in my daily routine. I also find time to learn about topics that I am passionate about. For example, these days I spend most of my time programming in [Go](https://golang.org/) which I enjoy immensely.

<include src="TweetQuote" quoteText="On being a platform engineer at Auth0: Some days I'm on-call and responding to incidents - those days are chaotic, but fun! -Dorrin Poorkay"/>

**On moving up to the challenge of scaling and maintaining a service that can’t have any downtime:**

When I came to Auth0, I was really looking for a challenge.

I started my career with a few internships during college and a few weeks before finals I landed my first job at a local startup. It was extremely fast-paced and as chaotic as small startups can be. I thoroughly enjoyed it until it was time for me to move on to a more challenging job.

What attracted me to Auth0 was the engineering talent, specifically evident in the engineers I spoke to [during the Auth0 interview process](https://auth0.com/blog/how-we-hire-engineers/), the [Auth0 blog](https://auth0.com/blog/), and, of course, the [identity platform](https://auth0.com/docs/getting-started/overview) product, but the big attraction was the challenge of scaling and maintaining a service that can’t have any downtime.

Working at a startup at a much smaller scale had its own challenges but things like writing postmortems, doing root cause analysis, measuring SLAs of services were not part of my daily job. Auth0 has a unique challenge of "can't be down at all.". We serve billions of authentication requests and none of them can fail. Banks, airlines, news websites, or anyone using Auth0 expect a very high Service Level Agreement (SLA) because our service is critical to the success of theirs.

**On keeping up with rapid changes in the engineering field:**

Engineering changes quickly. I keep up by reading — lots and lots of reading. I try to read a few articles every day. The tech industry moves very quickly, you have to keep up. I also implement new technologies I’m curious about in my personal projects. Although when there is not a lot of time to do personal projects, reading is still the best substitute.

I get a lot of my exposure to the tech industry's ins and outs from [Hacker News](https://news.ycombinator.com/), [my twitter feed](https://twitter.com/fseekme) and different Slack workspaces. In terms of books, I've been reading [Advanced Programming in the UNIX Environment](https://www.amazon.com/Advanced-Programming-UNIX-Environment-3rd/dp/0321637739). It might seem like it's not necessarily knowledge in the world of cloud, containers and serverless but it's a great read that continues to be helpful in my day-to-day job.

<include src="TweetQuote" quoteText="The tech industry moves very quickly, you have to keep up. -Dorrin Poorkay, Platform Engineer for Auth0"/>

**On her favorite project for Auth0 (so far):**

We had [another record growth year in 2018](https://auth0.com/blog/auth0-announces-record-year/) and are on track to continue that rapid growth. That means we’re always looking at ways to scale our systems to meet customer needs while we improve our products and services. Our product and engineering teams are also continuing to expand — we have to develop more tooling and services around our platform and infrastructure to keep up with our growth. My favorite projects (so far) aim to solve many of these challenges with code by blending programming and infrastructure knowledge.

**On what it’s like to work remotely from Louisville, KY and its great tech community:**

Most people think of fried chicken and bourbon when they hear Kentucky. While it is true that Kentucky has great chicken and bourbon, it also has great coffee shops, micro-breweries, and co-working spaces. Those places are usually where you see remote workers hacking away at their laptops.

I was born and raised in a big city, so it took a while to adjust to life in Louisville. I’d describe it as a big city with a small city feel. We have a close-knit tech community which has its own Slack workspace. We also have a lot of tech meetups around town. So if you’re working remote and looking to socialize with other software engineers, there’s plenty to do here!

->![Louisville, Kentucky](https://images.ctfassets.net/23aumh6u8s0i/5X808xp71KOaN6J34cZ69b/f70ed2c326fbe15bb0532245e6c14adf/louisville-kentucky-2)<-

Check out two of our local [meetup](https://www.meetup.com/) groups:

* [Kubernetes and Cloud Native Computing Louisville](https://www.meetup.com/Kubernetes-and-Cloud-Native-Computing-Louisville/)
* [Louisville AWS User Group](https://www.meetup.com/Louisville-AWS-Users-Group/)

**On the importance of calm leadership:**

During my on-boarding, I joined an incident call (we collaborate via video chat on incidents to facilitate communication). My fellow colleagues were on the call, but I noticed our Chief Technology and Product Officer and co-founder, [Matias Woloski](https://auth0.com/blog/authors/matias-woloski/) was also on the call. Even though he was incident-commanding and aware of the urgency, he remained calm. To me, this shows how Auth0 leadership contributes to a culture of openness where engineers are not afraid to touch production, make mistakes, ask questions, and be confident in taking ownership.

**On her favorite Auth0 value:**

That would have to be: [We are obsessed with delivering customer value](https://auth0.com/blog/our-culture-and-values-at-auth0/).

Most of what we do is for customers. Even though as platform/infrastructure engineers we don’t write code directly for the product, we still put a lot of emphasis on how a tool we’re implementing, a change we’re making, or infrastructure improvements affect customers.

**On being a woman in tech:**

Growing up my mom highlighted the importance of a role model. Being a surgeon, my mom was already a strong woman in a male dominant field. Because of her, nothing felt unachievable to me. I was encouraged to take classes like math and physics in school; I was very good at it. My grandfather also highlighted the importance of "allies" to me. An ally is basically an advocate that [boosts and draws attention to an oppressed group’s own voices](https://www.huffpost.com/entry/what-does-it-mean-to-be-a-male-ally_b_596d49d8e4b05561da5a5a05). He encouraged us, especially his daughters and granddaughters, to be career and science driven. I'd like to extend this analogy and say I find that having such role models and allies is beneficial to women in tech.

I have been privileged to work with great people over the years and my exposure to negativity has been small. Unfortunately, that's not the same experience for everyone. We need more allies, education, awareness, support, and empathy as we still fight discrimination and bias. This year, UI Engineer [Dasha Nikitina](https://www.linkedin.com/in/darianikitina/), R&D Content Engineer [Kapehe Jorgenson](https://auth0.com/blog/authors/kapehe-jorgenson/), and I will be attending [Women Who Code (WWC)](https://women.dev/) this Saturday, April 13th, in San Francisco. Come meet us at the Auth0 booth!

**On the advice Dorrin would give to someone interested in this field:**

First is to try to understand the reason behind your task. Why are you typing this command or writing code this way? This thinking gives you a deeper understanding of the tech you’re using. It also helps you with troubleshooting problems that might arise in the future, and for me personally, it brings a lot of joy to know the ins and outs of what I’m doing.

Second is to keep looking if you haven’t found the right place! There are so many companies with different cultures, tech stacks and standards that you can find a company that matches all your values.

**Join the Auth0 Team**

As you've learned, we are growing rapidly at Auth0. We have multiple engineering job openings available in our [career page](https://auth0.com/careers). You can learn more about our hiring and interview process through our [How We Hire Engineers](https://auth0.com/blog/how-we-hire-engineers/) post. If you have any questions or feedback, please let us know in the comments below!

---


Meet the Experts: Dorrin Poorkay

We break down the definition and offer ways to develop a solution that fits your needs.



Not that long ago, knowing who your business was interacting with was straightforward. You interacted with them directly. You shared a meeting room, shook their hand, or spoke with them over the phone.

But as the world becomes increasingly digital, tracking various users (customers and partners like vendors and consultants) is far less cut-and-dried.

Today, teams must find ways to understand who is accessing their systems and working with their data and, even more importantly, whether or not they’re actually supposed to be there. Put simply, companies must develop their own identity infrastructure.

## What Exactly Is Identity Infrastructure?

To create the right identity infrastructure for your team, it’s important to define what identity management means in the context of your business.

At Auth0, we define identity management as the cornerstone that glues internal teams and apps together in a single framework.

![Identity Infrastructure allows an organization to scale in a more secure and sustainable way](https://images.ctfassets.net/23aumh6u8s0i/1jLQlfdOeXRbAdsrWrXg2U/8319f8524e063e7416c367e2614ba0f8/what-is-identity-infrastructure-logo)

As organizations become larger and more distributed, and information is dispersed in more and more complex formats, companies often rush to implement systems and apps in an effort to be more connected and efficient. What most companies lack, however, is an underlying identity infrastructure.

Identity infrastructure allows an organization to scale in a more secure and sustainable way. It is the combination of technologies and processes that helps you manage the digital identities of every one of your users at any point in time. The best identity infrastructure is extensible and will evolve alongside your team.

## The Challenge with Identity Infrastructure

The importance of having a solid identity infrastructure in place can’t be denied. Unfortunately, both small businesses and larger enterprises often treat it as an afterthought.

“Organizations are flocking to cloud services and mobile devices to cut costs and boost productivity,” writes George Moraetes, in an [article for SecurityIntelligence by IBM](https://securityintelligence.com/meeting-identity-and-access-management-challenges-in-the-era-of-mobile-and-cloud/). 

“Despite the benefits, these technologies exacerbate the challenge of verifying identities and managing access to applications and data by consumers, employees and business partners from multiple devices and locations,” he adds.

> _“[Cloud] technologies exacerbate the challenge of verifying identities and managing access to applications and data by consumers, employees and business partners from multiple devices and locations.”_

Many businesses jump on cloud solutions and advancements without giving necessary thought to their identity infrastructure. This means they rely on [legacy systems](https://auth0.com/blog/how-do-i-modernize-my-legacy-system/) and antiquated processes for identity management, which can lead to headaches and security messes down the line. Older technologies can bring unnecessary redundancies — and companies miss out on opportunities to become more efficient and innovative. 

## How to Bring Your Own Identity Infrastructure into the Modern Age

The good news is that there are concrete steps that teams can take to either establish or improve their own identity infrastructure — both with their business partners and customers. What's better, you don't need separate systems for each category of users. The same identity infrastructure can underlie both.

### 1. MONITOR AND MANAGE ALL USERS WITH ONE CENTRAL VIEW.

Despite growing concerns about security, far too many companies don’t actually have clear insight into how users are behaving within their system.

With a solution like [Auth0’s Dashboard](https://auth0.com/docs/getting-started/dashboard-overview), you can observe all activity, broken down by individual user, at any point in time.

![Auth0 Dashboard View](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

With a dashboard view, you can also quickly make improvements to your system with options like:

* API registration
* Email template configuration
* Anomaly detection (which will instantly alert admins to suspicious activity)
* Basic identity management tasks like blocking or logging in as a user to help troubleshoot

A dashboard can improve the entire login experience for your users. A reported [25% of users](https://phys.org/news/2017-06-customers-passwords-business.html) forget their passwords daily and often need to use the system reset. According to Gartner, between 20% and 50% of help desk calls are for password resets, and [Forrester Research estimates](https://searchenterprisedesktop.techtarget.com/tip/Resetting-passwords-in-the-enterprise-without-the-help-desk) that the average cost of a single password reset done by a help desk is a whopping $70. 

Needless to say, having a straightforward place to manage both your application and your users that goes above and beyond passwords will save you and your team hassles, time, and, as a result, money. 

### 2. CONSIDER OUTSOURCING YOUR IDENTITY NEEDS.

Engineering teams balance hundreds of tasks every day to simply keep their systems up and running. If you're in the middle of a new product rollout, you need all hands on deck to be sure you deliver something of value for your customers on time. In these situations, outdated identity infrastructure shouldn't weigh you down.

[Outsourcing your identity needs can give you peace of mind](https://auth0.com/blog/cloud-scale-thinking-from-day-one-for-your-saas-products/) — knowing that you're working with the latest software out there and a team that's dedicated to this 24/7 (not juggling identity management with building and shipping new products, sourcing and investing in new tools, and managing junior developers).

Identity is a complex and quickly evolving discipline. An expert team like Auth0 can simplify it for you and give your team more time back to focus on tasks that are clearly tied to your bottom line.

### 3. STAY UP TO DATE WITH NEW SECURITY REGULATIONS.

Experience and ease of use are undeniably important considerations in identity infrastructure. But it’s not all about the bells and whistles. When you’re dealing with user identities, there are ever-evolving security concerns and regulations that you need to keep up with—from [GDPR requirements](https://auth0.com/gdpr/) to state regulations like the [California Consumer Privacy Act](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/) and even industry standards like [HIPAA](https://auth0.com/learn/why-hipaa-compliance-is-vital-your-business/).

That adds an extra layer of complexity to your identity infrastructure, which again speaks to the importance of finding a platform or solution that prioritizes security and compliance for you.

[Auth0](https://auth0.com/) supports industry-wide authentication standards and ensures compliance with the growing requirements of numerous leading organizations. 

## Identity Infrastructure Needs to Be a Priority

As the world becomes more connected and security concerns mount, businesses can no longer afford for identity infrastructure to be an afterthought.

But as a leader in your organization, you want to focus on increasing returns, not on establishing these processes and cleaning up security messes.

Building better identity infrastructure — or partnering with an expert third-party provider — will give you a stronger foundation for long-term growth. 

Fortunately, outsourcing the creation of your identity infrastructure gives you peace of mind while also freeing up your time to tackle projects that directly impact your bottom line. 

<include src="asides/AboutAuth0" />

---


What is Identity Infrastructure?

Savvy insurers are forging ahead with digital transformation. Don't let your team fall behind.



Many people believe the insurance industry is stagnant. However, in reality, insurance is constantly evolving.

As the world changes, insurance companies must provide new offerings to keep up. For example, insurance for driverless cars or rideshare services wasn't on the radar of most insurance companies until only a few decades ago. And, new technologies — such as drones and [IoT](https://auth0.com/blog/security-for-smart-home-devices/) — also challenge insurance companies to keep pace.

Add to that [increasing customer expectations](https://auth0.com/blog/how-to-keep-up-with-hyperconnected-consumers/), new threats to security, [the rise of insurtech](https://useindio.com/how-to-defend-insurance-agency-against-insurtech/), and ever-changing regulatory requirements, and the insurance industry is anything but dry.

However, despite these frequent shifts, too many insurance companies are resistant to digital transformation, and that resistance means they risk falling behind — or worse.

## What Exactly is Digital Transformation?

[Digital transformation](https://auth0.com/app-modernization) is more than just an oft-repeated buzzword. Put simply, digital transformation means leveraging technology. Digital transformation refines or even [automates existing business processes](https://auth0.com/blog/staying-safe-in-the-automated-workplace/) to ultimately improve the operation of your business and the experience of your customers.

“Insurers that digitize the enterprise in this way can automate slow, error-prone and expensive processes for increased speed, accuracy and cost efficiency,” explains a [whitepaper for EY](https://www.ey.com/Publication/vwLUAssets/ey-digital-transformation-in-insurance/$FILE/ey-digital-transformation-in-insurance.pdf).  

![Outdated infrasrtucture presents risks](https://images.ctfassets.net/23aumh6u8s0i/2tHULoDyNDOhrE58j4hLPJ/8bf6a6e1653a647f3e5c73c2e821aaa2/outdated-computer)

[Image via Pexels](https://www.pexels.com/photo/computer-computer-keyboard-contemporary-display-257881/)

When executed correctly, digital transformation will streamline and simplify company operations for both short-term and long-term gains.

## The Risks of Outdated Infrastructure in Insurance

Despite the numerous benefits of digital transformation, many people still bristle at the idea. Change is difficult, and in an industry like insurance — where established firms have succeeded with business-as-usual for decades — introducing new technologies can ruffle some feathers.

However, failing to keep up comes with numerous risks and consequences.

Of course, cybersecurity is top of mind for many companies. But, it’s become a major priority in the insurance industry.

Hackers are increasingly [targeting insurance companies](https://www.cio.com/article/2899488/data-breach/health-insurance-companies-prime-targets-for-hackers.html) because they deal with sensitive customer information for the claims and underwriting processes — such as healthcare and financial data — yet are notoriously slow to implement measures to protect themselves and their customers.

International business auditing firm KPMG [surveyed more than 100 insurance CEOs](https://home.kpmg/qm/en/home/insights/2017/01/facing-the-cyber-threat-in-the-insurance-sector.html). Less than one in five of them believed that their company was adequately prepared for a cybersecurity threat.

Any sort of cyber event or data breach is undeniably bad for business. First, there’s the financial fallout. [Liberty Mutual’s shares dipped by 4%](https://www.businesslive.co.za/bd/companies/financial-services/2018-06-19-liberty-share-falls-after-data-breach/) in June of 2018 after the company disclosed a recent data breach.

In the well-known breach of the information of approximately [78 million policyholders at Anthem](https://www.insurancejournal.com/news/east/2017/10/10/466958.htm), the company agreed to pay $115 million to settle lawsuits resulting from the breach. The total amount that event cost them is more than triple that, once you include costs associated with incident response and resulting security enhancements.

Finances aside, a disregard for changing technologies and increased security threats can have dire effects on a business’ relationship with customers as well.

When customers feel that their private information isn’t treated with the care and consideration it deserves — such as in the case of a [State Farm customer](https://abc7news.com/technology/exclusive-sj-woman-discovers-security-breach-in-state-farm-app/775904/) who discovered a breach within the company’s app when she was able to access other policyholders’ information — all trust is lost.

"How can I not worry?” the customer said in an [interview with ABC7 News](https://abc7news.com/technology/exclusive-sj-woman-discovers-security-breach-in-state-farm-app/775904/). “Who has my information if I have their information?"

## What Insurance Companies Can Do to Step Into the Digital Age

Digital transformation is a must for insurance companies; however, the risks of botching an update that compromises vast sensitive data are real. How can insurers move forward without fear?

Here are three strategies insurance companies should use to protect themselves and their customers and improve their businesses in the process.

![Digital transformation is a must for insurance companies](https://images.ctfassets.net/23aumh6u8s0i/6vRX3OydveKV04LmxKKJF5/48b97c4270ecba8e0be7b1dedcaf9fc7/new-computer)

[Image via Pexels](https://www.pexels.com/photo/person-using-macbook-374720/)

### 1. Implement Better Customer Identity Management Measures

Nearly all insurance companies provide a portal for customers to log in and access their profiles, personal information, claim statuses, and more. But legacy systems for user registration and authentication are a barrier they need to move past.

Insurers need to establish better [customer identity management](https://auth0.com/b2c-customer-identity-management) to make it easy for customers to access their accounts— while making it simultaneously difficult for hackers.

### 2. Invest in advanced features like Anomaly Detection to Better Identify System-Wide Threats

Unfortunately, it’s far too easy for breaches and other malicious events to go undetected for a surprisingly long time.

As just one example, an [investigation into the well-known breach at Anthem](https://www.bankinfosecurity.com/new-in-depth-analysis-anthem-breach-a-9627) revealed that it all started with a lone phishing email that was opened by an employee in February 2014.

However, Anthem wasn’t able to [disclose the attack and notify customers](https://www.usatoday.com/story/tech/2015/02/05/anthem-health-care-computer-security-breach/22917635/) until February 4, 2015 — a year after it all began. By that point, the hacker had compromised at least 90 systems within the Anthem enterprise environment.

This speaks to the importance of having [anomaly detection](https://auth0.com/docs/anomaly-detection) in place that can alert you and your users of suspicious activity the moment it happens. Auth0 not only makes you aware of the attempts to access your application, but also blocks future login attempts—so you can catch the problem before it becomes even bigger.

### 3. Ensure You’re Up to Date With Changing Security Regulations

The increasing threats in the insurance industry haven’t gone unnoticed. That’s exactly why security regulations and requirements continue to be introduced to mitigate the potential of malicious activity.

[GDPR](https://auth0.com/gdpr/), which went into effect in May 2018, requires that organizations using data of EU citizens abide by a set of strict standards when collecting, processing, storing, and sharing personal information. Teams that fail to comply could be fined €20 Million or up to 4% of annual revenue.  The regulation has had a [ripple effect](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/) across the world, with states like California following suit.

And, the insurance industry itself has taken steps toward stricter regulations and protective measures. The [National Association of Insurance Commissioners](https://www.naic.org/cipr_topics/topic_cyber_risk.htm) formed the Cybersecurity (EX) Working Group in response to the increasing demands on insurance companies. (These charges now fall under the Innovation and Technology (EX) Task Force.)

Before disbanding, this group completed numerous cybersecurity activities. Most notably among these was the adoption of the new Insurance Data Security Model Law (#668), which requires insurers and other entities licensed by state insurance departments to develop, implement, and maintain an information security program, investigate any cybersecurity events, and notify the state insurance commissioner of such events.

Keeping up with these sorts of regulations can be challenging, but Auth0 makes it painless. The platform supports industry-wide authentication standards and ensures compliance with the growing requirements of numerous leading organizations. Plus, [Auth0’s extensibility features](https://auth0.com/app-modernization) ensure that your identity platform can grow and evolve along with your business and industry.

![Stay up to date with changing security regulations](https://images.ctfassets.net/23aumh6u8s0i/2FdDc3lTZZSe4yBmMKpWwP/0779ad8e95312299b7fafc971e57dc77/security)

[Image via Pexels](https://www.pexels.com/photo/internet-screen-security-protection-60504/)

## Updating Legacy Systems: Insurers Need to Keep Up

The above steps will help insurance companies protect their information as well as the information of their customers. However, there’s also no neglecting the importance of employee education and awareness.

The better trained and informed insurance teams are about suspicious activity, the less likely they are to fall for various phishing scams and attacks.

Combine thorough employee training with the above tips, and insurers will step into the digital age — while also improving their businesses and customer relationships.


How Insurance Teams Can Quickly Step Into the Digital Age

Key solutions like anomaly detection, universal login, and custom security rules delivered by Auth0 helps its customers protect sensitive user data.



Tight infrastructure security is critical — but if you don't remember to secure your web applications, customer data remains exposed.

There are several [common threats to web-app security](https://auth0.com/blog/common-threats-in-web-app-security/):

- A lack of encryption between your web browser and their servers
- XSS (cross-site scripting) that occurs when malicious scripts are injected into web applications
- Clickjacking (when an attacker injects transparent or opaque objects into a web application)
- Cross-site request forgery (where the attacker impersonates an authorized user and requests sensitive information, such as passwords)

These threats are continuing to multiply and become more complex by the day. To mitigate breaches, particularly in a time of [heavy regulatory scrutiny](https://auth0.com/docs/compliance/gdpr), Auth0 offers three major strategies:

1.  Anomaly Detection
2.  Universal Login Support
3.  Customizable Rules

Auth0 allows you to combine these features to further amplify protection for your app's end users. While you can always attempt to develop these and similar solutions in-house, outsourcing app security will give you access to a team of experts who work 24/7 to keep up with the latest trends in a constantly evolving space.

## Anomaly Detection

Auth0 provides three built-in shields that [detect anomalies](https://auth0.com/docs/anomaly-detection) among users in an app's system. Used separately or in combination, the shields have the ability to stop malicious access attempts before they occur. Administrators receive alerts of suspicious activity and can then block future login attempts by an aberrant user.

<include src="TweetQuote" quoteText="Learn more about how Auth0 provides three built-in shields that detect anomalies among users in an app's system."/>

### Brute-Force Protection

Within its [Brute-Force Protection](https://auth0.com/docs/anomaly-detection) feature, Auth0 has two distinct shields:

1.  Shield 1 is triggered after 10 failed login attempts on a single account from the same IP address.
2.  Shield 2 is triggered after 100 failed login attempts from a single IP address via different usernames in 24 hours or after 50 sign-up attempts in one minute from the same IP address.

When Shield 1's threshold is reached, an email is automatically sent to the user, which an administrator can edit however he or she wishes. This initial email looks like:

![Affected user email](https://images.ctfassets.net/23aumh6u8s0i/7Hf4QzvX6IDVi6gl4hGRp4/8fc62d71de2ae3698d64c087b89c730c/affected-user-email)

An administrator can easily edit the template by accessing the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and following Emails > Templates.

When Shield 2 is triggered, dashboard administrators are notified. Brute-Force Protection will also block the suspicious IP address. When the issue is resolved, an administrator simply locates the user in the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and files an action to unblock. A user can also click on the "unblock" link provided in the email above or change their password.

### Breached-Password Detection

The third shield is breached-password detection. This is easy to turn on and customize in the Anomaly Detection section of the Auth0 dashboard.

![Breached-password anomaly detection with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3Oe0VufANczOhCpPtuL8iV/99ffa473077e16cd7733334c25a9c73d/breached-password-shield)

Breached-password detection is useful in instances where Auth0 suspects that a user's email has been compromised in a major security breach. (Auth0 consistently tracks these on third-party sites.) If this occurs, Auth0 will trigger the shield, notify the user, and block them from logging in until they reset their information. Breached-password detection is becoming increasingly helpful as many individuals use the same or similar iterations of the same password on multiple sites.

<include src="TweetQuote" quoteText="When Auth0 suspects that a user's email has been compromised in a security breach, Auth0 will trigger a protective shield, notify the user, and block them from logging in until they reset their information"/>

## Universal Login

Auth0 supports [universal login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) on customer apps. In contrast to embedded login, this offers increased security and a shorter setup time.

![Auth0 Universal Login offerings](https://images.ctfassets.net/23aumh6u8s0i/21BR2xIUfU721nga9W1FqO/184597f0a961d89938bb9923b08e6a73/centralized-embedded-diagram)

Universal login is a more seamless experience for the user. On the front end he or she sees a simple authentication request; on the back end, credentials remain within the same domain instead of being sent across origins. This makes it a far more secure method than exposing the information to outside sources. When personal data moves from one origin to another, [phishing attacks](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) and [man-in-the-middle attacks](https://auth0.com/docs/security/common-threats#man-in-the-middle-mitm-attacks) become common.

In addition to an enhanced customer experience, universal login is simpler for administrators to maintain and provides the benefits of single sign-on (SSO).

## Auth0 Security Rules

Auth0 has developed customizable [Rules](https://auth0.com/docs/rules/current) for its app-security features. Rules are JavaScript functions that execute when a user authenticates to your application. Rules can be helpful when customizing and extending Auth0's existing capabilities. For example, the [Force Email Verification](https://auth0.com/rules/email-verified) and [User Fraud Score](https://auth0.com/rules/socure_fraudscore) Rules can be incorporated into Auth0's existing tools like Anomaly Detection to better determine if a user truly is who they say they are.

### Force Email Verification

Force Email Verification only allows app access to users who have verified their emails. Incorporating Force Email Verification into an app instead of a browser version is a good UX practice with powerful back end capabilities.

![Force Email Verification code](https://images.ctfassets.net/23aumh6u8s0i/6MhbfE6DYpGdnku3wGI9Rn/4dd87042b24817242ccde8b52d16c781/verify-email-code)

[[Source](https://auth0.com/rules/email-verified)]

For example, if you are working with a large set of emails that belong to a network, e.g., `@university.edu` or `@company.edu`, Force Email Verification can help parse individuals in a group to make sure that a fake user hasn't set up an account to blend in with the others. Force Email Verification requests that users cross-check their information; anyone who returns information that doesn't match or does not return additional information at all will be blocked from logging in.

### User Fraud Score

Like Force Email Verification, you can tack on the User Fraud Score to a variety of features. If you've built an online marketplace — like Etsy, for example — you can use this rule to cross-check everyone conducting business and thus add an extra layer of protection to purchases. The Rule calculates a fraud score for every user, based on their email address and IP address.

```javascript
function (user, context, callback) {
  // score fraudscore once (if it's already set, skip this)
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

  if(!user.email) {
    // the profile doesn't have email so we can't query their api.
    return callback(null, user, context);
  }

  const request = require('request');

  // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
  request({
    url: 'https://service.socure.com/api/1/EmailAuthScore',
    qs: {
      email:  user.email,
      socurekey: configuration.SOCURE_KEY,
      ipaddress: context.request.ip
    }
  }, function (err, resp, body) {
    if (err) return callback(null, user, context);
    if (resp.statusCode !== 200) return callback(null, user, context);
    const socure_response = JSON.parse(body);
    if (socure_response.status !== 'Ok') return callback(null, user, context);

    user.app_metadata = user.app_metadata || {};
    user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
    user.app_metadata.socure_confidence = socure_response.data.confidence;
    // "details":[
    //     "blacklisted":{
    //        "industry":"Banking and Finance",
    //        "reporteddate":"2014-07-02",
    //        "reason":"ChargeBack Fraud"
    //     }
    // ]
    user.app_metadata.socure_details = socure_response.data.details;

    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
        context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
        context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
        callback(null, user, context);
      })
      .catch(function(err){
        callback(null, user, context);
      });
  });
}
```

In the Auth0 Dashboard, copy the code block above, and replace placeholders with the appropriate values. The rule will pull the fraud score from socure.com and store it on app_metadata. A full set of Auth0 Rules can be found [here](https://auth0.com/docs/rules/current).

For fraud detection, Auth0 partners with [ThisData](https://auth0.com/blog/anomaly-detection-safer-login-with-thisdata-and-auth0/). ThisData allows real-time detection of any account takeovers across both web and mobile apps.

## No Better Time To Secure Your Apps

Securing your app with the best tools is always a good decision — but it is especially timely, given the slew of new regulations: GDPR deadline has passed, but [it's not too late to comply](https://auth0.com/blog/your-quick-gdpr-compliance-checklist/), and several countries and states in the U.S. have followed the EU with [similar privacy initiatives](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/). In line with these events, Auth0 has developed additional [strategies](https://auth0.com/gdpr-assessment/) for getting your team into alignment quickly, including [customer identity and access management (CIAM) protocol](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/).

While it might be easy to forget your apps in the swirl of demands around your core operations — making sure you plug any holes here is key to ensuring that you don't become another [data-breach statistic](https://consequenceofsound.net/2018/06/ticketfly-hacker-data-breach/).


"infrastructure"