Loading…
Topic
Identity
7 posts about Identity. Every summary links to the original.
- 7 posts
- 3 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Auth0 Metadata Explained: user_metadata vs app_metadata
Auth0’s user_metadata and app_metadata define a security boundary: user_metadata is writable by users through the update:current_user_metadata scope, while app_metadata requires privileged scopes available only to confidential clients via the client credentials grant. Post-login Actions reading authorization data like subscription plans or feature flags from user_metadata allow users to escalate privileges by modifying their own metadata, for example setting plan to enterprise and beta_access to true. Writing to app_metadata demands a server-side M2M application with update:users_app_metadata scope, which no public client or user token can obtain. The correct practice is to store access-control data such as roles, tenant membership, and IP allowlists in app_metadata, and non-sensitive preferences like theme or language in user_metadata. A third field, client_metadata, holds application-level properties readable via event.client.metadata in Actions.
Architecting Secure Identity: Extending Auth0 PrivateLink with Intelligent Gateways
Enterprises centralize authentication into a single Auth0 environment but must comply with frameworks like PCI-DSS, HIPAA, and SOC 2 that restrict data to private channels. Auth0 Outbound PrivateLink provides a secure unidirectional connection between Auth0 and AWS infrastructure, avoiding the public internet. However, a single PrivateLink connection per environment cannot directly reach multiple isolated VPCs for staging and production. The Intelligent Gateway Pattern solves this by deploying an API gateway or reverse proxy at the PrivateLink termination point to fan out traffic. Auth0 Actions append context such as custom headers like X-Target-Env or specific paths, and the gateway inspects these to route requests to the appropriate isolated VPC, decoupling secure transport from internal routing. This pattern unblocks identity consolidation by allowing a single Auth0 tenant to serve both staging and production workloads while maintaining strict VPC isolation.
Connecting customer context to measurable ROI with agentic marketing
Customer journeys have become non-linear while identity signals decay, and marketing value is shifting from reach frequency to a prediction economy that rewards anticipating needs. AI agents can recommend or take the next-best action for each customer within human-defined guardrails, with each action measured incrementally against what would have happened without it. Identity resolution must be continuous, connecting known and pseudonymous signals across channels, to provide reliable context for agent decisions. The context required includes customer behavior, business objectives, decision history, and control guardrails, with a single transaction carrying up to 50 metadata parameters. A practical starting point is focusing on one meaningful decision, such as reactivating lapsed customers, and expanding as trust and results build.
Introducing SCIM Provisioning in ClickHouse Cloud
ClickHouse Cloud introduces SCIM 2.0 provisioning, making the identity provider the single source of truth for user membership and role assignments. Previously, SAML SSO handled authentication but left user invites and role updates as manual tasks, creating security risks. SCIM provisioning automatically syncs user create, update, and delete operations from the IdP using standard SCIM 2.0 endpoints, maps IdP groups to custom ClickHouse roles via stable external IDs, supports up to two API keys for rotation, and provides audit logging for all provisioning actions. The feature requires an active SAML connection, is limited to verified domain SSO users, excludes system roles like Admin, and revokes all keys if SAML is disabled. It is generally available for Enterprise and BYOC organizations, validated with Okta and Microsoft Entra ID, and eliminates manual invite and deprovisioning tasks.
Seven Architectural Readiness Checks Before Production Launch
Auth0’s free tier supports up to 25,000 MAUs for MVPs, but teams must complete seven architecture checks before production launch to avoid blockers. The checks cover Auth0 Organizations for multi-tenancy, Enterprise Connections for SSO, Custom Domains, JIT hash migration, Fine-Grained Authorization, MFA factor progression, and tenant lifecycle management. The free plan caps Organizations at five, Enterprise Connections at one plus unlimited Okta, and MFA at passwordless and passkeys only. Upgrading to B2B Essentials or Professional unlocks unlimited organizations, up to five enterprise connections, and advanced MFA including TOTP, WebAuthn, push, and SMS; Professional also enables Custom Database migration scripts. Teams must add a credit card for Custom Domains, add a secondary admin to prevent tenant deletion after 150 days of inactivity, and note that FGA free trial supports 100 MAUs and 50,000 tuples for prototyping.
Introducing IdentiFlows.dev: A Visual Reference for Identity Flows
Developers often struggle to quickly find accurate sequence diagrams for OAuth 2.0 and OpenID Connect flows. IdentiFlows.dev is a new website that provides a visual reference for common identity protocols, organized into four categories. Each flow page includes an introduction explaining the flow’s purpose, a sequence diagram showing the full exchange, and a step-by-step breakdown of each stage, with an interactive mode to walk through the steps. The initial release covers eight flows, including OAuth 2.0 Authorization Code with PKCE, the recommended login flow for most modern apps, SAML 2.0 SP-Initiated SSO, DPoP-Bound Access Token requests, and OpenID Connect Discovery. The project is an early release with plans to add more flows like Client Credentials, Device Authorization, and WebAuthn, and the author invites feedback to guide development.
Securing Agentic Commerce Using Auth0 and the Universal Commerce Protocol (UCP)
Auth0 is bringing secure identity to the Universal Commerce Protocol (UCP) so retailers can safely let AI agents discover and purchase products on shoppers’ behalf. UCP is an open standard that gives AI agents a consistent way to interact with a merchant’s catalog, cart, and checkout, reducing the need for separate integrations per platform. Auth for UCP provides the identity and trust layer, handling agent registration, account linking, and scoped temporary token issuance through an on-behalf-of token exchange. This ensures that every purchase ties to a verified human with time-limited access and a full audit trail, while agents see only the authenticated shopper’s data. Auth0 is opening Auth for UCP Limited Early Access to select customers through its Agentic Commerce Partnership Program.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.