Authorization (B2B)

Let's start by taking a step back and talking about Access Control. There isn't one clear cut definition of Access Control in the industry, but if you spend some time searching and reading, you'll see that most authoritative sources agree that it is the umbrella concept that puts all of Authentication, Authorization, Consent, and Policy Enforcement together to ensure that only the right people and services have access to your applications and APIs.

Next, let's look more closely into the distinctions between Authentication, Authorization, Consent, and Policy Enforcement. Your Auth0 tenant (your Authorization Server) is typically responsible for Authentication and Consent, and some or all of Authorization and Policy Enforcement. Additionally, an Application or API itself almost always is the primary enforcer of policies, especially where contextual access is required:

• Authentication: the process of determining if a principal (a user or application) is who or what they say they are.

• Authorization: the process of determining what is allowed, based on the principal, what permissions they have been given, and/or the set of contextually-specific access criteria.

• Consent: what permissions the user (Resource Owner) has given permission to an application to do on its behalf. This is generally a requirement of delegated authorization. The user has to give permission to the Client to access the user's data in a different system.

• Policy Enforcement: The act of enforcing the policies of the application or API, rejecting or allowing access based on a user's authentication and/or authorization information.

In general, we typically group different types of access control into three distinct categories so that it's easier to understand a) which actor is responsible for storing the information, b) which actor is responsible for making decisions, and c) which is responsible for enforcing the restrictions.

• The first category is where access is either granted or denied to an application or an API in its entirety. Both the data required to enforce this and the enforcement process is typically defined in the context of the Authorization Server For example, by using app_metadata associated with a user and a Rule defined in your Auth0 tenant.

• The second category is where access is either granted or denied to a specific subset of application or API functionality. The data required to enforce this is typically stored in the Authorization Server For example, by using app_metadata on a user in your Auth0 tenant with the enforcement process performed in the application or API itself. In this scenario, the data is typically communicated as one or more custom claims in an id or access token.

• The third category is where access is either granted or denied depending on what the principal (subject) can operate on within the context of an application or API. Both the data required to enforce this, and the enforcement process is typically defined in the context of the application or API. In this scenario, the data communicated as one or more custom claims in an id or access token may be consumed with or without data from an external source that is not Auth0.

In addition, Role-based Access Control (RBAC) and Attribute-based Access Control (ABAC) mechanisms can be applied in any of the Access Control categories described above. Whatever your use case then, there are a number of things you will want to consider when looking at the functionality and workflow you require:

• Are there scenarios where access to an entire application or API should be rejected?

• Will you be providing APIs that can be accessed by third-party applications?

• Will your APIs also be accessed by your own (first-party) applications?

• Will your application be calling a third-party API?

• Should your applications and/or APIs be enforcing access control based on user claims?

• What if I need to know which organization an access token or ID token is associated with?

Auth0 supports access restriction for either applications or APIs based on certain conditions. In certain scenarios, you may want to create a Rule that returns an UnauthorizedError when, for example, a user attempts access to an application or an API at an incorrect time (as described in this example)—or if the user doesn’t have the right claim(s) contained in their app_metadata. For an application using OpenID Connect (OIDC), this would prevent the allocation of the ID Token used to authorize access. Similarly, for an API, allocation of any OAuth2 Access Token (used when calling the API), could be prevented as described in this example.

Auth0 also can provide the information needed so that an application can enforce restrictions. For application level integration, Auth0 allows you to add custom claims to an ID Token, which your application can then verify and subsequently use to perform policy enforcement. In this case you will need to decide what information you require for your application to make enforcement decisions. If you need to make decisions at an API instead of in your application, you will likely need to use an Access Token instead of an ID token. Continue reading for more information.

For API level integration, Auth0 supports both custom claims as well as scope re-configuration, both within the context of an Access Token. Again, you will need to decide what information will be required in order for your API to make access decisions, and your API will need to enforce that by validating the contents of the Access Token.

For multi-organization scenarios, it can often be important to know which organization an access token (or even an ID token) applies to. Taking care to follow the best practices can save you time and effort.

In this scenario, your Auth0 tenant provides a token as an indicator of authorized access to an application. For applications utilizing OpenID Connect (OIDC), the industry-standard protocol we typically find most utilized when it comes to customer facing applications, this would be an ID Token expressed as a JWT.

Using Rule extensibility, Auth0 allows you to easily add custom claims to an ID Token based on, for example, a user’s metadata content. Your application can then verify the ID Token for the necessary claims, and either allow or prevent access to certain functionality as required. Note that though the process of adding custom claims via Rule is streamlined, the Rule engine is flexible and allows you to write custom code that may have negative effects. Therefore it’s important to follow our rules best practice guidance anytime you use this extensibility feature.

If you are creating different instances of your application for your customer organizations, a common practice is to create a custom claim in your ID token to represent the user's organization. For example:

context.idToken["http://yourdomain.com/claims/organization"]= "organization A";

OIDC Scopes are typically used by an application to obtain consent for authorized access to a user's details during authentication. Each of the pre-defined scopes returns the set of standard claims where defined, and as described in the OIDC specification. The scopes an application requests depend on which user attributes the application needs. Once the requested scopes are authorized by the user, the claims are returned in the ID Token and are also made available via the /userinfo endpoint.

In this scenario your Auth0 tenant can provide an OAuth2 Access Token, typically expressed as a JWT, which can be used by your API to restrict access to certain parties. In addition, Auth0 provides support for what is notionally described as both First-Party and Third-Party Applications.

Acting as the authorization server, and with the consent of the user (the resource owner), your Auth0 tenant can be used to provide an Access Token—typically expressed as a JWT—to an application (client) so that it can access a protected resources hosted by a resource server on behalf of the resource owner. The issued Access Token is typically passed as the Bearer token in the HTTP Authorization header sent to an API.

Whether you have a single API, or perhaps a suite of logically related microservice APIs, you can leverage the Access Tokens that Auth0 provides in order to secure access to your service(s). Though relatively easy to set this up in the Auth0 Dashboard or through the Auth0 Management API, it's important to review the different application scenarios and API layouts to determine the best architecture for your system.

OAuth2 was designed specifically with third-party access in mind, For example, a scenario might be that a user (resource owner) wants to use an application (a client) that does not belong to the same organization as the service that provides the user's data (the reseource server). In this case, when the application needs to access data that the user owns, it redirects to the organization where the user’s data resides, which in turn authenticates the user and then prompts the user to give the application permission to access their data. This prompting for permission is referred to as providing consent and is a large part of what providing support for third party applications entails. If you are planning to integrate third-party applications, then it's important you mark them as third-party early on so that Auth0 will handle prompting for user consent.

On the other hand, if your organization owns the application(s), the user data itself and the API(s) through which that data is accessed, then consent is not typically required as the interactions are all first-party. If you're only creating first-party applications, then you can ensure that you are not presenting your users with any unnecessary consent screen(s) by allowing user consent to be skipped as part of any resource service definition.

Alternatively, you may have data relating to a user for which additional functionality is provided and for which explicit user consent cannot be obtained (i.e. there is no authenticated user who can provide it). In this scenario, a list of applications for which Client Credentials grant is enabled can be defined.

As is the case with ID Tokens, you can add custom claims to Access Tokens using Auth0 Rule extensibility. Once added, your API can then verify an Access Token for the necessary claims and either allow or prevent access to certain functionality as required.

OAuth2 Scopes are typically used as the mechanism by which an API can determine what actions can be performed on behalf of a user. Scopes can be added on a per API basis to define specific access permissions in the Auth0 Dashboard or through the Auth0 Management API). Scopes can also be manipulated via Auth0 extensibility (e.g. via a Rule, as in this example). The scopes an application requests for accessing an API should depend on what functionality the application needs the user to give permission for the application to use. Once the requested scopes are authorized, they will be returned in the Access Token which can be subsequently verified by said API. A good example of this is when you log in to an application that is using a social provider for login: the social provider API requires that the application specifies whether the user will want the application to post items on your behalf. This allows the user to accept or deny this request. This example demonstrates how the user is delegating permission to the application—which is different than the API restricting access based on a user's role, and should be handled differently.

Though scopes are often used as a way to enforce access permissions for a user, there are situations where it can become tricky when you use them in this manner. We therefore recommend that you use scopes for their intended purpose (i.e. delegating permission to an application) and use custom claims for your role-based or other access control scenarios.

Fine Grained Authorization allows you to grant individual users access to a specific resource or object based on:

• A user's role within an organization, such as editor or admin

• An attribute of the user or object, such as manager for a user or marketing for an object

• A relationship between a user and an object, such as a user with view access to a parent folder also has view access to the child folder

With FGA, you can create an authorization model to determine what relationship you want to determine user access.

Auth0 has out-of-box support for Role Based Access Control (RBAC). RBAC refers to assigning permissions to users based on their role within an organization, and provides for simpler access control by offering a more manageable approach that is less prone to error.

The core RBAC feature can be used in many multi-organization scenarios. See Organization Data in an Access Tokens for more information on how to ensure your setup can support your RBAC needs.

There are many scenarios that require an application without any user-interactive session to obtain an access token in order to call an API. In such scenarios you must authenticate the client instead of the user, and OAuth 2 provides the client credentials grant type to make this easy to achieve. Some common examples of where this is required include:

• A cron job or other service that needs to communicate with your API (e.g. where a daily report needs to be generated and emailed it to an administrator).

• A separate API the supports privileged access (e.g. the API is not exposed to users directly, but instead to a backend only).

• In certain microservice architectures, where some API layers need to communicate to other API layers without a user involvement, or after a user token has expired.

• A privileged API that may need to be called before a user has authenticated (i.e. from a rule or custom DB script in your Auth0 tenant)

If you have a separate API from your application in your system that supports your multi-organization application, it is important to restrict operations to only the organization that the token was generated for. This requires that there is some sort of information in the access token to tell the API which organization the access token was issued for. This can be done in a couple of different ways depending on the answers to a couple of simple questions:

1. Will the End Users in this organization potentially have more than one organization, or is each End User isolated to a specific organization?

2. Will you be allowing any Machine-to-Machine (M2M) access to your API?

3. If you are allowing Machine-to-Machine (M2M) access to your API, Will you have any developers who need a single client ID and secret to access multiple organizations (but not all organizations)?

4. Will you be allowing the creating of third-party apps that require consent?

If End Users are isolated to a single organization and you will either not be allowing M2M access to your API or you will have a separate client ID/secret for each organization that needs access and you will not be allowing third-party apps that require consent, then the simplest approach is to just create a custom claim in the access token using rules for the user based tokens and using the client credentials hook for M2M calls. You can store organization name in client metadata and extract it from rules or hooks to include in access_token as a custom claim. RBAC will work out of the box for this approach as well as long as each End User can only belong to one organization.

If End Users have more than one organization they can belong to or you might give a single developer a client ID and secret for M2M calls to more than one organization, the best approach is to create a separate audience (a separate API instance in your Auth0 tenant) for each organization. This gives you a few nice abilities:

1. First, it allows you to pass the audience as a first-class parameter to Auth0 without having to create a custom parameter. The benefit of this is that Auth0 will help enforce the existence of the audience, and it will pass it to your rules. It will also ensure that an issued refresh token will only work for the specific audience it was originally issued to.

2. It allows you to restrict client grants to only specific organizations out of the box. The alternative is to create a more complicated client credentials hook to attempt to retrieve the restrictions from somewhere else and also require a much more complex and potentially troublesome way to tell the client credentials call which organization to issue the access token for.

3. This also allows you to use the core RBAC feature with Auth0 and ensure that the End Users who have access to more than one organization can have a potentially different role for each organization.

We provide planning guidance in PDF format that you can download and refer to for details about our recommended strategies.

Many B2B platforms implement some form of isolation and/or branding for their customers' organization, and this can add complexity to any Identity and Access Management (IAM) system. If this applies to you, then we recommend you take some time to read through our guidance and best practice advice for this type of environment.

Multiple Organization Architecture