Delivering a B2C IAM Project
An Auth0 planning guide tobusiness-to-consumer identity andaccess management

auth0-tfg-00001 version March 7, 2024
1Introduction
This document provides guidance for integrating Auth0 within abusiness-to-consumer (B2C) identity and access management (IAM) project.
Based on our experience working with customers who’ve implemented Auth0 for
this type of project, we’ve developed a set of goals and milestones that will help
you plan your solution efficiently and deliver it effectively.
Before you begin, consider the following items:
1. Identify your primary objectives and determine the requirements to achievethem.
2. Use a phased approach across multiple workstreams.
3. Adopt an iterative release process.

Identify your primary objectives
If you determine the key goals of your project early on, it helps your teams focus
on the specifics when building out your solution.
For example, if your primary objectives are to avoid disruption for end users andprovide continuity of service, then you consider adopting an iterative releaseprocess instead of a “big-bang” approach when integrating with Auth0.

Use a phased approach
A phased approach across multiple workstreams will help your teams divide andconquer. Many implementation tasks can be completed in parallel, which allows
your team to reach milestones faster and present your project to stakeholders
sooner.
This is also a good time to check if other groups within your organization havebeen working with Auth0. There may be opportunities to share first-handexperience with the product, consolidate resources, and inform the structure ofyour implementation.
We may be able to help you identify these teams and provide guidance forcollaboration.

© 20242Adopt an iterative release process
An iterative release process will help your teams reduce cognitive overload andimprove velocity of development.
For example, if you have three or four applications you want to integrate withAuth0, consider working on one application at a time. This way, your teams cantake what they learned from the previous iteration into the next one.
If you have multiple applications and you want Single Sign On (SSO) support,
read Architecture to help you understand what you need to consider when using
an iterative release process.

© 20243

Phase 1: Application integration and User Authentication
Workstreams
TenantAssociation

CustomDomains

Provisioning

User
Migration

Self Sign Up

Authentication

Universal
Login

Username andPassword
Authentication

Application
Integration

Universal
Login

CustomDomains

Architecture

TenantProvision

SDLC
SupportAnomaly
Detection
Email
Templates

ChangePassword

Error Pages

Quality
Assurance

Unit
Testing

Integration
Testing

Mock
Testing

ProfileManagement

Metadata

Password
Reset

Authorization

ID Token
ClaimsLogoutLogoutBranding
Deployment
Automation

Deployment

EmailProvider

Operations

Firewall

Logging

Milestone 1© 2024

4Milestones

Branding

Milestone 1

Authentication. Demonstration tostakeholders.

Design & Development

Milestone 2

Profiles, branding, authorization.
Demonstration to stakeholders.

Operations & Infrastructure

Milestone 3

Go-Live. Deployment toproduction.

Testing

BlockedUsers

Monitoring
Milestone 2

Audience

LegendAccount
Verification

Milestone 3

Notifications

ServiceStatus

Phase 1
The first phase focuses on integrating your application(s) with Auth0 to provide
user authentication. You’ll address the ten key stages to go-live across three key
milestones, and conclude with a production-ready implementation that integrateswith Auth0 to provide user authentication across your application(s).
The workstreams, the topics they address, and the order you complete them in isimportant, so we recommend you follow these guides closely.
Some topics can be worked on by different teams in parallel, such as Provisioning,Authentication, and Branding. If you assign a topic to the team that has the mostexperience with it (such as your design team to Branding), you can accelerate
implementation with minimal overlap.

Architecture
The Architecture workstream must consider how your application(s) fits in yourorganization, what the user base looks like, how to structure your Auth0 assets,
and whether there are opportunities for cross-integration.
Topics include:●●●●Tenant Provision
Custom Domains
Tenant Association
Software Development Life Cycle (SDLC) Support

Provisioning
The Provisioning workstream must consider how users sign up with yourapplication(s), which identity providers you will support, and how and what user
data will be stored.
The Provisioning workstream can complete their work in parallel with theAuthentication and Branding workstreams.
Topics include:● User Migration● Self Sign Up© 2024

5

The Auth0 Dashboard (along with the Delegated Administration extension)
can be used out-of-box to perform user provisioning and deprovisioning.
If you require more comprehensive deprovisioning functionality - say forcompliance reasons - then refer to the Provisioning guidance provided inPhase 2.

Authentication
The Authentication workstream must consider how users will prove their identity,
how you’ll balance user experience and security, and what levels of additional
authentication are necessary (such as Multi-factor authentication or Step-up
authentication).
The Authentication workstream can complete their work in parallel with theProvisioning and Branding workstreams.
Topics include:●●●●

Universal Login
Username and Password Authentication
Application Integration
Anomaly Detection

Branding
The Branding workstream must consider how to customize the look and feel ofAuth0 to align with your organization’s requirements, and provide a consistentuser experience to instill trust in your brand.
The Branding workstream can complete their work in parallel with the Provisioning
and Authentication workstreams.
Topics include:
●
●
●
●
●

Universal Login Customization
Custom Domain
Change Password Customization
Error Page Customization
Email Template Customization (read Operations guidance before doing so)© 20246

Deployment Automation
The Deployment Automation workstream must consider how to manage thedevelopment and release cycle for Auth0 assets, how to ensure a dynamic
development environment, and how to guarantee a stable production
environment.
Topics include:● Software Development Life Cycle (SDLC) Support● Tenant-Specific Variables

Quality Assurance
The Quality Assurance workstream must consider how to detect breakages inyour Auth0 integration and how to mitigate the resulting impact to users.
Topics include:● Unit Testing● Mock Testing● Integration Testing

Profile Management
The Profile Management workstream must consider how to manage user profile
data, user account verification and recovery, and user account restriction.
Topics include:●●●●Metadata Management
Password Reset
Account Verification
Blocked Users

Authorization
The Authorization workstream must consider how and what user data is passed
between the authorization server and the application(s).
Topics include:© 20247

● ID Token Claims

Logout
The Logout workstream must consider how users terminate their application,Auth0, and identity provider sessions.
Topics include:●●●●

Session Layers
Session Lifetime Limits
Log Users Out of Applications
Log Users Out of Identity Providers

Operations
The Operations workstream must consider how emails and notifications are sent
to users, how to monitor Auth0 user activity, and how to process Auth0 log data.
Topics include:
●
●
●
●
●

Email Provider Setup
Monitoring
Logging
Firewall Configuration
Notifications

Next steps
At this point, you’ve integrated your application(s) with Auth0, configured user
authentication, and are ready for production.

© 20248Phase 2: API Authorization, Advanced Authentication, Provisioning, and Profile Management
Workstreams
Architecture

Provisioning

Authentication

Social Sign Up
Single Sign On (SSO)
with Legacy Auth
SystemMulti-Factor
Authentication

Social Login

Branding

Guardian Multi-Factor

Deployment
Automation

Deployment

Quality
Assurance

Unit Testing

Integration Testing

ProfileManagement
Authorization

Mock Testing
User Account
Linking

Roles andPermissions

API Integration

LogoutOperations

Notifications
Milestone 1

Milestone 2

Audience

Legend9

Milestones

Branding

Milestone 1

API integration. Demonstration tostakeholders, deployment to production.

Design & Development

Milestone 2

Advanced features. Demonstration tostakeholders, deployment to production.

Operations & Infrastructure

Milestone 3

Go-Live. Deployment to production.

Testing© 2024

Milestone 3

Service Status

Phase 2
The second phase focuses on integrating your API(s) with Auth0 to provide
authorization functionality, and configuring social connections.
Additionally, the Authentication, Deployment Automation, Provisioning, andLogout workstreams address topics that allow for advanced functionality.
The workstreams, the topics they address, and the order you complete them in isimportant, so we recommend you follow this guide closely.

Authorization
The Authorization workstream must consider how your API(s) will be integrated
with Auth0, and how access management will be handled (policy and method).
The Authorization workstream can complete their work in parallel with theAuthentication and Deployment Automation workstreams.
Topics include:● API Integration● Roles and Permissions

Authentication
The Authentication workstream must consider how users log in to yourapplications and if there are areas for improvement.
The Authentication workstream can complete their work in parallel with theAuthorization and Deployment Automation workstreams.
Topics include:● SSO with the Legacy Authentication System● Social Login● Multi-Factor Authentication© 202410

Deployment Automation
The Deployment Automation workstream must consider how to integrate Auth0with your continuous integration/continuous deployment (CI/CD) pipeline.
The Deployment Automation workstream can complete their work in parallel withthe Authorization and Authentication and workstreams.
Topics include:● Deploy CLI Tool
● Auth0 Terraform Provider

Quality Assurance
The Quality Assurance workstream must consider how to detect breakages inyour Auth0 integration and how to mitigate the resulting impact to users.
Topics include:● Unit Testing● Mock Testing● Integration Testing

Provisioning
The Provisioning workstream must consider how Enterprise connections will besupported.
Topics include:● Social Sign-Up

Branding
The Branding workstream must consider how to customize the look and feel ofAuth0 to align with your organization’s requirements and provide a consistent user
experience to instill trust in your brand.
Topics include:● Customize Multi-Factor Authentication Pages© 202411

● Auth0 Guardian

Logout
The Logout workstream must consider how users terminate their application,
Auth0, and identity provider sessions.
Topics include:● User Redirect● Session Termination

Next steps
You’ve now integrated your API(s) with Auth0, configured API authorization
policies, and introduced advanced functionality in several workstreams.

© 202412

Phase 3: Extended Use Cases for Authentication, Profile Management, and Operations
Workstreams
Architecture

Provisioning

Authentication

Signup by Invitation
Step-upAuthentication
RedirectPages

Branding
Deployment
AutomationDeployment

Quality
Assurance
ProfileManagement

Integration
Testing

Unit Testing
ProgressiveProfiling

Mock Testing

Email Verification

Authorization

LogoutOperations

Companion Application
Milestone 1

Milestone 2

Audience

Legend13

Milestone 3

Milestones

Branding

Milestone 1

Extended use cases. Demonstration tostakeholders, deployment to production.

Design & Development

Milestone 2

Specialized customization. Demonstration
to stakeholders, deployment to production.

Operations & Infrastructure

Milestone 3

Go-Live. Deployment to production.

Testing© 2024

Notifications

ServiceStatus

Phase 3
The third phase addresses complex use cases, including support for additionalauthentication and specialized customization.
Additionally, the Authentication, Profile Management, Branding, Provisioning, andOperations workstreams address topics that allow for advanced functionality.
The workstreams, the topics they address, and the order you complete them in is
important, so we recommend you follow this guide closely.

Authentication
The Authentication workstream must consider how to handle use cases that
require additional user verification.
Topics include:● Step-up Authentication

Profile Management
The Profile Management workstream must consider how to enrich user profile
data and verify user email addresses.
Topics include:● Progressive Profiling● Email Verification

Branding
The Branding workstream must consider how to maintain a consistent user
experience across all user journeys.
Topics include:● Redirect Pages© 202414Provisioning
The Provisioning workstream must consider how to manage alternative signup
scenarios.
Topics include:● Signup by Invitation

Operations
The Operations workstream must consider whether development of a companion
application is necessary.
A companion application allows your organization’s internal members (such as acustomer support team) to perform actions on behalf of your users. For more
information, ask your Technical Account Manager for details.

© 202415Conclusion
Thank you for reading this guide on Auth0 integration in a business-to-consumer(B2C) identity and access management (IAM) project.
This guide and its contents are occasionally updated based on our continuingexperiences with customers. We recommend you check with our scenario
guidance as you progress.
For more detailed information regarding certain functionality or would like todiscuss a specific use case, please contact our Professional Services team.

© 202416