Authentication – Discover Auth0

Login

The Login Box

For user authentication (typically known as Login), it’s pretty much the first thing you’ll experience. In today’s modern e-commerce environments, however, there’s often more to the login box than meets the eye!

Hi, I’m Peter Fernandez, an Innovator, Architect, Consultant, Engineer, and Principal Developer Advocate at Auth0 by Okta. I’d like to share with you some of my experience building user authentication – a.k.a. Login – into modern applications and how easy it is to do that using the Auth0 platform.

More than just UserID and Password…

In the world of modern application development, Login is a whole lot more than just acquiring a UserID & Password. With the rich source of user information offered by the likes of Social Login and the convenience of using security-enhanced workflows like Passkeys – not to mention the commercial flexibility offered by Enterprise Federation – there’s so much more to the process.

…more than just credential verification

It’s more than just credential verification too. The Login Box also has to be capable of employing Attack Protection strategies. And with safety and security being of paramount importance to many consumers, it has to provide for the likes of MFA too. Users also want a Sign-in/Signup experience that’s as frictionless as possible, so the likes of SSO and progressive User Profile enrichment are important considerations.

Sign in…

Login – a.k.a. Sign-in – typically starts with an interaction that we’re probably all familiar with: the interactive supply of credentials for verification. Credentials come in a number of different forms, the most common being the UserID and Password. But other forms associated with the likes of Social, Enterprise Federation, and Passwordless scenarios exist too. Once credentials are verified, an application will typically establish the session for the user and, optionally, an SSO session can be established too.

…vs Sign out…

The converse process is typically known as Logout, Logoff, or Sign out. When a user has finished interacting with an application, they will typically terminate their session explicitly, effectively de-authenticating. Or the application will terminate their session implicitly if no user interaction has occurred for a period of time. Optionally, a Logoff will terminate the SSO session too – so that the user must engage with the Login process interactively if they wish to use the application again.

Before anyone can log in, they typically have to be a registered user of an application first. That process is typically referred to as Signup and is typically where the user chooses their credential information – such as UserID and Password. However, with the likes of Social Login and Enterprise Federation, Signup is often implied: when user credentials are verified by a 3rd party, the process of user registration typically becomes implicit rather than explicitly actioned.

Build it yourself?

You could build support in-house, yourself. That’s true. Click on the image to read more about doing just that, and watch the recording of my related webinar here. If your team has the resources, time, capacity, knowledge, and expertise in developing SSO; deploying Attack Protection; leveraging OIDC and/or SAML for Authentication, Social and/or Enterprise Federation; implementing Passwordless and/or MFA, and/or (optionally) OAuth 2.0 for API Authorization – then it’s definitely an option. But what if there was a better way?

Say hello to Auth0 Universal Login! Universal Login allows you to create a fully customized authentication experience that supports all of the capabilities you need from a Login/Sign In, Sign Up, and Sign Out experience too. With out-of-the-box support for the likes of SSO, Passkeys, advanced MFA, progresive User Profile enrichment, Social Login and Enterprise Federation, Universal Login offers a range of fully flexible configurations. But it doesn’t stop there. Fully brand the experience however suits, and leverage Attack Protection strategies that are leading edge. All at the push of a button!

Social Login

In addition to the classic UserID & Password or Passwordless workflows, fast-track the signup and login experience for your customers with user authentication via 53+ out-of-box Social Login options that they know and trust. All being enabled by the flip of a switch.

Enterprise Federation

For use cases such as B2B and B2B2C, leverage the Identity Provider (IdP) already used by an organisation to provide user authentication via Enterprise Federation.

Attack Protection

Employ Protection against a range of attacks, with features such as Bot Detection, Breached Password Detection, and Suspicious IP Throttling.

Adaptive MFA

Enable Adaptive MFA, and fine-tune your user authentication process via intelligent MFA that dynamically fits customer login behaviors. All whilst satisfying your business needs.

Passwordless

For a secure, seamless, and all-around easier user experience, implement a Passwordless workflow and do away with the password at the flip of a switch.

Extensibility

Customize identity flows with visual drag-and-drop Actions to build functionality that will address your unique requirements.

Integrate with ease

With a variety of out-of-box options provided by a wide range of SDKs, you can build an initial integration with Auth0, written in any programming language and supporting any technology stack, in a matter of hours. Click on the image to visit the Auth0 SDK website and discover how to integrate with ease.

Verified Credentials…

Modernizing an application to exchange the verification of a UserID and Password credential with the verification of a credential-verified artefact opens up a variety of opportunities. Providing the flexibility to deliver user-centric information that helps build the application session, for example, and the ability to explore the likes of SSO, MFA and Passwordless scenarios too. Leveraging a totally independent IDP, such as Auth0, supports all of this without the need to change a single line of that modernized code.

…via OIDC…

OIDC provides industry-standard verified authentication via JSON Web Format (JWT) ID Tokens and opens up the world of Social Login too! B2C application builders not only defer the authentication process to a third party but at the same time can leverage rich sources of user profile information in a regulatory compliant manner. Further, offering OIDC-compliant user authentication flows provides the means for your application(s) themselves to become Social authenticators if and when desired.

With SAML, you have full access to the world of B2B and B2B2C opportunities in a way that best suits you and your business needs. Via the comprehensive flexibility of an IdP platform like Auth0, automatically enable Enterprise Federation connectivity in your application(s) via the flick of a switch: no need to spend precious time and effort on anything other than your core business logic. And if you need to switch between the two – i.e. OIDC and SAML – easily do that too!

Showing care and consideration helps users feel valued: something which ultimately helps to bring them back time and again. Universal Login offers best practice guidance and provides out-of-box workflows that are designed with accessibility in mind – helping to provide your users with an altogether inclusive experience right from the get-go. Click on the image to read more about how building an accessible user experience can help level the digital playing field for everyone!

Architected Scenario Guidance

Whatever scenario you’re building for, Auth0 has comprehensive guidance to help you navigate through the design decisions often faced when building a Customer Identity & Access Management solution. Let our architecture scenario guidance for both B2C and B2B help you prepare for any eventuality.

Want to learn more?

Okta provides a wide range of courses to help you level up your skills. Why not click on the logo to see what you can discover with Okta Training today?!

Stay informed

Helpful Identity & Access Management articles that are timely and relevant, whatever your level of experience. Whether you prefer to learn by reading, listening, watching videos, cloning repos, copying code, or attending a workshop or conference: content is everywhere and made for developers like you. Click on the image to subscribe to the newsletter today!

Begin the journey…

Sign up here, and create a free Auth0 Tenant to begin your journey. Play with prototyping an integration of your existing code – or develop something new; experience the Okta Customer Identity Cloud, powered by Auth0, in a way that best suits you.

…or try a Demo.

If you’re looking for some inspiration, why not take a look at some of the pre-build demos at demo.okta.com – where you can test-drive sample integrations for both the Okta Customer Identity Cloud and the Okta Workforce Identity Cloud too!

Passwordless workflows free users from the traditional password that’s typically associated with first-factor authentication. Passkeys are the latest development in passwordless technology, and provide the most advanced flexibility and security when it comes to verifying customer credentials without using passwords!

What are Passkeys?

Based on the WebAuthn specification, a Passkey is a discoverable public key cryptographic credential that provides a fully-flexible user experience across multiple devices. Passkeys are the next generation of advanced user authentication that offer the most compelling replacement to the password so far!

WebAuthn and the FIDO alliance

Web Authentication (a.k.a WebAuthn) is a specification by the W3C and FIDO – an alliance formed with the participation of Google, Mozilla, Microsoft, Yubico, and others. This specification provides for first-factor authentication of a user using public key cryptography instead of a password.

How do Passkeys work?

By leveraging public key cryptographic in conjunction with platform trusted device technology – such as biometric fingerprint or facial recognition – Passkey workflow provides proof that you are in possession of your device. And thus satisfies the various aspects of zero-trust user authentication in one go: something you are, something you know, and something you own.

Next-level WebAuthn

WebAuthn allows folks to leverage secure public key cryptography via the use of their secure (biometric enabled) device, as a replacement for UserID and Password credentials. Passkeys takes this even further, providing for cryptographic credentials that are easily discoverable across devices. Click on the image to learn more about Passkey technology, and see it in action.

On a personal device – such as a personal phone, tablet, or laptop – the Passkey generated for a particular site is also saved to the distributed Keychain associated with the provider. For an Apple device, for example, this typically means that the generated Passkey is saved to the iCloud Keychain associated with the Apple ID credentials with which the device is configured.

…Public Devices…

However, there are cases where you may need to use a public device that’s not configured with your provider specific credentials (i.e. your Apple ID, Google ID, etc). In such cases, the Passkey protocol supports signin using what’s often referred to as the “nearby device” workflow. In this scenario, a QR can be scanned by a camera equipped personal device in order to utilize the Passkey it may contain.

…across multiple platforms

With many providers – such as Apple – the QR code mechanism also extends to creating Passkeys on non-personal devices. Which can then be stored in the provider distributed Keychain. And QR code workflows can be used with devices on different platforms too – regardless of whether they’re personal or public in nature.

Build it yourself?

Meet Universal Login

Auth0 Universal Login allows you to create a fully customized user authentication experience, that incorporates Passkeys at the push of a button! And one that supports features like SSO and MFA too, right out-of-the-box! Integrate Universal Login as part of your login workflow, and let us focus on providing seamless access to all of the capabilities supported by the Auth0 platform, whilst you focus on building the core experience of your application.

Integrate with ease

Stay informed

Begin the journey…

…or try a Demo.

Enterprising SSO

Enterprise Federation – also referred to as SSO – allows you to leverage the Identity Provider (IdP) already employed by an Enterprise. Valuable in some B2C application scenarios, this facility paves the way for making B2B and B2B2C opportunities a reality, opening the door to additional lines of revenue!

Hi, I’m Peter Fernandez, an Innovator, Architect, Consultant, Engineer, and Principal Developer Advocate at Auth0 by Okta. I’d like to share with you some of my experience building user authentication, using Enterprise Federation, into modern applications and how easy it is to do that using the Auth0 platform.

User Authentication using SAML….

User authentication in a federated context typically utilizes the SAML protocol. SAML is an industry standard designed to facilitate an enterprise-trusted relationship where a 3rd party can authenticate against the IdP used by an organization. When it comes to integrating the protocol there is a lot to understand. Both ends of a login conversation speak SAML, and when they do, a valid user-authenticated context is determined by the use of a SAML Assertion rather than a UserID and a Password. SAML essentially pioneered SSO, and can also leverage the likes of MFA and Passwordless too.

….or OpenID Connect

Federated user authentication can also support the use of OpenID Connect. OpenID Connect – a.k.a. OIDC – is an industry standard alternative to SAML that requires far less configuration from a trust perspective, yet still provides sufficient security for many enterprise use cases. OIDC is typically a lot easier to manage than SAML. However, there is still just as much to understand when it comes to integrating the protocol. When both ends of a login conversation speak OIDC, a valid user-authenticated context is determined by the use of a JWT format ID Token rather than a UserID and a Password. OIDC also enables the likes of Social authentication. Like SAML, OIDC supports SSO, and can leverage the likes of MFA and Passwordless too.

Authentication via the Browser

Enterprise authentication typically requires the use of browser-based workflows – where an application navigates to the federated IdP in order to obtain either an Assertion or a JWT format ID Token, following successful user authentication. Not only does this require the potential re-architecting of existing application logic, it also requires that developers understand the subtle nuances and vaguaries of each federated providers’ implementation.

SP Initiated…

In SAML, the Service Provider – a.k.a. the SP – is the entity that receives and accepts the (SAML) assertion generated by the IdP. One can typically think of the SP as a Web Service – i.e. a Web Application – that can talk SAML protocol. With SP-initiated workflow, it’s the Service Provided Enterprise – the Web Service/Application – that solicits the authentication request with the IdP.

…vs IdP Initaited

In a SAML IdP-initiated workflow, the converse is true: the IdP is the entity that initiates the authentication request, delivering a (SAML) assertion to the SP in an unsolicited fashion. IdP-initiated flows are valuable in providing support for externalized SSO scenarios, where a user may come to an application via the likes of an external web portal or dashboard interface.

Build it yourself?

Federate using Universal Login

Auth0 Universal Login allows you to create a fully customized user authentication experience that includes Enterprise Federation at the push of a button! And one that supports features like SSO and MFA, right out-of-the-box too! Integrate Universal Login as part of your login workflow, and let us focus on providing seamless access to all of the capabilities supported by the Auth0 platform – whilst you focus on building the core experience of your application.

Connectivity out-of-the-box

Leverage the IdP already used by an organisation with ease via a wide range of readily available Enterprise Connections. All at the flip of a switch! You can even set up Auth0 as either a SAML Service Provider, a SAML Identity Provider, or some combination of both; see here for more details.

Out-of-the-box Organization too

Employ Organizations to provide ready-made B2B support, where user isolation and application branding can be configured on a per organisation basis.

MFA

Add MFA for enhanced security – even if it’s not provided by the federated IdP! With Auth0 Adaptive MFA, you can fine-tune the user authentication process using intelligent multi-factor access management that dynamically fits customer login behaviours. All whilst satisfying your business needs.

Extensibility

Customize identity flows with visual drag-and-drop Actions to build functionality that will address your unique requirements.

Integrate with ease

Architected Scenario Guidance

Stay informed

Begin the journey…

…or try a Demo.

What is Authentication?

Authentication is the process of identifying access to a system in order to secure the features/facilities it provides. Even if your application doesn’t require secure access, implementing authentication can enable you to provide a consistent context no matter how that application is used.

Hi, I’m Peter Fernandez, an Innovator, Architect, Consultant and Engineer. I want to share with you some of my experience building Authentication (a.k.a. AuthN) into modern applications and how easy it is to do that using the Auth0 by Okta platform.

User Authentication

User Authentication is the process of identifying a user to your application in order to secure access to the features that the application provides. User authentication is typically performed via the interactive Login process with which we’re all familiar. But even if your application doesn’t require secure access, implementing user authentication can still enable you to provide your users with consistency – like a consistent profile context, which they can take with them no matter how they log in.

Machine Authentication

Machine Authentication provides secure access in a context where there is no user. Instead of an interactive login, a (fixed) set of ID & Password credentials are typically utilized instead. A somewhat less familiar mechanism, Machine Authentication, is used between services or devices when they need to communicate securely with each other – either in the foreground or in the background. Whilst Machine Authentication can be used in situations where processing occurs on behalf of a user, it’s more often used in situations where a user was never present at all.

User authentication, commonly known as Login, typically starts with an interaction where a user supplies their credentials for verification. Credentials come in a number of different forms, the most familiar being the UserID and Password. But forms associated with Passwordless authentication, Social, and Enterprise scenarios exist too. Once credentials are verified, an application will typically establish the session for the user, and, optionally, an SSO session can be established too.

…vs Logout

The converse process is typically known as Logout. When a user has finished interacting with an application, they will typically terminate their session explicitly via a logout, effectively de-authenticating. Or the application will terminate their session implicitly if no user interaction has occurred for a period of time. Optionally, a Logout can also terminate any SSO session – so that the user must again engage with the Login process interactively if they wish to use the application(s).

First-Factor…

The degree to which user authenticity (and, in some cases, machine authenticity) needs to be proven can vary considerably. First-factor authentication – typically known as (User)ID & Password authentication, but can include the likes of Social or Passwordless authentication – is always a given. However, certain scenarios, such as those that involve performing financial or (security) sensitive transactions, often benefit from the use of one or more additional factors.

…vs Multi Factor

Multi Factor Authentication, typically known as MFA, refers to the process whereby one (or more) factors are required in addition to whatever First-Factor authentication occurs for a user. MFA – also known as 2-Factor Authentication (or 2FA) where only one additional factor is used – provides for the additional verification of a user. MFA can occur immediately after First-Factor authentication or, in cases where SSO is utilized, under certain conditions typically referred to as Step-Up Authentication.

Authentication vs Authorization

Where Authentication is the process of identifying access to a system, Authorization – a.k.a AuthZ – is typically referred to as the process of determining exactly what permission for access is allowed. And it invariable requires Authentication as a pre-requisite!

Authentication Scenarios

Authentication comes in all shapes and sizes. From B2C oriented scenarios – where users are your direct customer – to B2B and B2B2C scenarios, where users are often other people’s customers too. And there are work force scenarios too, often referred to as B2E, where users are (also) employees of an organization. With workflows optionally using Passwordless, MFA and Social, thru service level access using machine authentication and all the numerous combinations in between, these are the use cases where Authentication plays a vital role. And you can click on the image to find out more in the provided guide.

Build it yourself?

Meet Universal Login…

Auth0 allows you to create a fully customized user authentication experience at the push of a button! With Auth0 Universal Login you can easily support features like SSO, Social and MFA, as a standard part of the out-of-box Login workflow. Let us focus on providing seamless access to all of the capabilities supported by the Auth0 platform – whilst you focus on building the core experience of your application.

…and the Authentication API

But user authentication is just a part of the story! Whether you’re building for B2C, B2B, or some combination, Auth0 – via its Authentication API – provides full programmatic access to all of the authentication capabilities on offer, making it easy to integrate for machine authentication or any other (custom) authentication use case. All whilst leveraging the full power of the platform at the same time.

Login

Technically known as UserID & Password login, fast-track development of both sign-in and signup experiences for your customers with beautifully branded workflows. All being integrated as part of Auth0 Universal Login out-of-the-box. Click on the image to discover more.