<commit_before>---
title: "API-Powered Authentication and Authorization for the Win"
type: whitepaper
sitemap: false
description: Learn how you can solve custom and complex authentication scenarios with just a few lines of code, using Auth0's powerful, easy-to-use APIs.
hash: api-driven-authentication
pdf: http://google.com/link-to.pdf
fourKeyConcepts:
  -
    text: Leveraging the Auth0 Rules Pipeline
    icon: css-class-bud-icon
  -
    text: Creating Dynamic Roles and Authorizations
    icon: css-class-bud-icon
  -
    text: Profile Enhancement On The Fly
    icon: css-class-bud-icon
  -
    text: Multi-party Authentication Flows Made Simple
    icon: css-class-bud-icon
  
longDescription: >
 In this white paper, we’ll look at some common use cases that go beyond the core features found in the Auth0 Dashboard, and see how an API-driven approach delivers more flexibility, and ultimately the best user experience.
shortTagline: When you have a rich API for Identity Management, even complex authentication flows become easy to implement.
---
# API-Powered Authentication and Authorization For The Win

* * *
<div class="toc-box"></div>

## OVERVIEW / EXECUTIVE SUMMARY

Almost by definition, users are at the heart of any identity management system. You need to add them, remove them, let them log in and authorize them to access appropriate resources. You need to monitor, log, audit and manage them. When you add in privacy and regulatory compliance concerns, what seems like an easy bit of software quickly spirals into a big challenge. 

Auth0 has a unique, developer-centric approach. Some IAM products build every possible scenario for provisioning and managing the user population into a complex, hard-to-use and inflexible user interface managed by IT admins. Auth0 is different. The platform exposes a flexible, easy to use developer API that hides complexity behind a normalized and simple set of endpoints and schemas and a simple but powerful rules engine. Coupled with convenient SDKs for nearly any stack, the Auth0 API enables developers to build unique customizations.

Other solutions lock you into inflexible approaches they’ve developed in a vacuum, but with Auth0, you can integrate your own identity requirements directly into your application and quickly get into production. In this white paper, we’ll look at some common use cases that go beyond the core features found in the Auth0 Dashboard, and see how an API-driven approach delivers more flexibility, and ultimately the best user experience.

## DYNAMIC ROLES AND AUTHORIZATIONS

With Auth0, you have the ability to add users from a wide range of connected identity providers, and grant them access to your applications. But what if you need more fine-grain control over which applications users may access, and the specific rights they have within those applications? With Auth0, you can handle this common use case by storing a set of permissions as part of the user metadata associated with each account. Your applications can check the appropriate metadata field to grant or deny access as appropriate.

Simple enough, but how do you manage those metadata fields? You might want to create a set of "roles" for your organization, and assign application permissions to those roles. Each user would then be assigned one or more roles and gain the corresponding permissions for their roles.

You can see this model in action with the sample [Roles and Permissions Dashboard](https://github.com/auth0/auth0-roles-permissions-dashboard-sample) application - open source software from Auth0, on GitHub. 

![](/media/articles/email-wall/whitepapers/api-driven-authentication-and-authorization/Roles-Permissions-Sample.png)

**Figure 1: Roles and Permissions Sample Application**

You can fork this project and use the sample code as the foundation of a solution customized to your unique situation.

Another option: if your organization represents these roles as groups within an enterprise IdP such as Active Directory, when a user authenticates to your AD, Auth0 can execute a rule which computes the union of permissions across all of the user’s group memberships and add those permissions to the outgoing authentication token dynamically. An enterprise CMS like SharePoint could allow or restrict access to specific internal sites based on this computed permission data. This dynamic "chaining" of group permissions is only possible with Auth0’s powerful, flexible rules. Other tools do simple authorization. But Auth0 orchestrates complex authorization workflows with just a few lines of code, executed within the authentication pipeline. You have the power to handle authorization according to your needs, not limited by inflexible tools.

## ON THE FLY ANALYTICS AND PROFILE ENHANCEMENT

Rules are not just for authorization. The ability to reliably execute arbitrary code in the authentication pipeline can power advanced, server side features that would be difficult or impossible to implement unless you start from a blank slate and build your IAM solution from scratch.

Creating an account using Auth0’s self-service signup is a powerful signal of engagement. What if you could record that data in your data warehouse, or using an analytics tool such as Mixpanel? You can, with a rule: 
```javascript
function (user, context, callback) {

  if(user.signedUp) return callback(null,user,context);

  var mixPanelEvent = {
    "event": "Sign Up",
    "properties": {
        "distinct_id": user.user_id,
        "token": <PASSWORD>,
        "application": context.clientName
    }
  };

  var base64Event = new Buffer(JSON.stringify(mixPanelEvent)).toString('base64');

  request('http://api.mixpanel.com/track/?data=' + base64Event,
           function(e,r,b){
                  if(e) return callback(e);<commit_msg>Update icons on Email Wall Whitepapers<commit_after>---
title: "API-Powered Authentication and Authorization for the Win"
type: whitepaper
sitemap: false
description: Learn how you can solve custom and complex authentication scenarios with just a few lines of code, using Auth0's powerful, easy-to-use APIs.
hash: api-driven-authentication
pdf: http://google.com/link-to.pdf
fourKeyConcepts:
  -
    text: Leveraging the Auth0 Rules Pipeline
    icon: budicon-342
  -
    text: Creating Dynamic Roles and Authorizations
    icon: budicon-285
  -
    text: Profile Enhancement On The Fly
    icon: budicon-292
  -
    text: Multi-party Authentication Flows Made Simple
    icon: budicon-328

longDescription: >
 In this white paper, we’ll look at some common use cases that go beyond the core features found in the Auth0 Dashboard, and see how an API-driven approach delivers more flexibility, and ultimately the best user experience.
shortTagline: When you have a rich API for Identity Management, even complex authentication flows become easy to implement.
---
# API-Powered Authentication and Authorization For The Win

* * *
<div class="toc-box"></div>

## OVERVIEW / EXECUTIVE SUMMARY

Almost by definition, users are at the heart of any identity management system. You need to add them, remove them, let them log in and authorize them to access appropriate resources. You need to monitor, log, audit and manage them. When you add in privacy and regulatory compliance concerns, what seems like an easy bit of software quickly spirals into a big challenge.

Auth0 has a unique, developer-centric approach. Some IAM products build every possible scenario for provisioning and managing the user population into a complex, hard-to-use and inflexible user interface managed by IT admins. Auth0 is different. The platform exposes a flexible, easy to use developer API that hides complexity behind a normalized and simple set of endpoints and schemas and a simple but powerful rules engine. Coupled with convenient SDKs for nearly any stack, the Auth0 API enables developers to build unique customizations.

Other solutions lock you into inflexible approaches they’ve developed in a vacuum, but with Auth0, you can integrate your own identity requirements directly into your application and quickly get into production. In this white paper, we’ll look at some common use cases that go beyond the core features found in the Auth0 Dashboard, and see how an API-driven approach delivers more flexibility, and ultimately the best user experience.

## DYNAMIC ROLES AND AUTHORIZATIONS

With Auth0, you have the ability to add users from a wide range of connected identity providers, and grant them access to your applications. But what if you need more fine-grain control over which applications users may access, and the specific rights they have within those applications? With Auth0, you can handle this common use case by storing a set of permissions as part of the user metadata associated with each account. Your applications can check the appropriate metadata field to grant or deny access as appropriate.

Simple enough, but how do you manage those metadata fields? You might want to create a set of "roles" for your organization, and assign application permissions to those roles. Each user would then be assigned one or more roles and gain the corresponding permissions for their roles.

You can see this model in action with the sample [Roles and Permissions Dashboard](https://github.com/auth0/auth0-roles-permissions-dashboard-sample) application - open source software from Auth0, on GitHub.

![](/media/articles/email-wall/whitepapers/api-driven-authentication-and-authorization/Roles-Permissions-Sample.png)

**Figure 1: Roles and Permissions Sample Application**

You can fork this project and use the sample code as the foundation of a solution customized to your unique situation.

Another option: if your organization represents these roles as groups within an enterprise IdP such as Active Directory, when a user authenticates to your AD, Auth0 can execute a rule which computes the union of permissions across all of the user’s group memberships and add those permissions to the outgoing authentication token dynamically. An enterprise CMS like SharePoint could allow or restrict access to specific internal sites based on this computed permission data. This dynamic "chaining" of group permissions is only possible with Auth0’s powerful, flexible rules. Other tools do simple authorization. But Auth0 orchestrates complex authorization workflows with just a few lines of code, executed within the authentication pipeline. You have the power to handle authorization according to your needs, not limited by inflexible tools.

## ON THE FLY ANALYTICS AND PROFILE ENHANCEMENT

Rules are not just for authorization. The ability to reliably execute arbitrary code in the authentication pipeline can power advanced, server side features that would be difficult or impossible to implement unless you start from a blank slate and build your IAM solution from scratch.

Creating an account using Auth0’s self-service signup is a powerful signal of engagement. What if you could record that data in your data warehouse, or using an analytics tool such as Mixpanel? You can, with a rule:
```javascript
function (user, context, callback) {

  if(user.signedUp) return callback(null,user,context);

  var mixPanelEvent = {
    "event": "Sign Up",
    "properties": {
        "distinct_id": user.user_id,
        "token": YOUR_MIXPANEL_TOKEN,
        "application": context.clientName
    }
  };

  var base64Event = new Buffer(JSON.stringify(mixPanelEvent)).toString('base64');

  request('http://api.mixpanel.com/track/?data=' + base64Event,
           function(e,r,b){
                  if(e) return callback(e);
{'fraction_non_alphanumeric': 0.04884340871958036, 'fraction_numerical': 0.005159515005589475, 'mean_word_length': 4.493623051487955, 'pattern_counts': {'":': 10, '<': 8, '<?xml version=': 0, '>': 10, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6819217', 'n_tokens_mistral': 2799, 'n_tokens_neox': 2693, 'n_words': 1580}