Auth0 multi-tenant architecture - Multiple Database connections

Question

We currently use Auth0 for authentication and use the user.app_metadata object to store information about the tenant for each user. We also have a requirement to list users per tenant.

Sadly Auth0's policy is that you cannot search app_metadata fields when querying users.

You can however filter users using the identity provider, so per tenant i've created a custom database connection.

The question is how can i log in user in using multiple customer database connections also using the hosted pages? If i provide an array of available connections using the options.allowedConnections object it just defaults to the first connection, meaning users that are not on that connection can't login.

What am i doing wrong here?

 var lock = new Auth0Lock(config.clientID, config.auth0Domain, {
  auth: {
    redirectUrl: config.callbackURL,
    responseType: (config.internalOptions || {}).response_type ||
      config.callbackOnLocationHash ? 'token' : 'code',
    params: config.internalOptions
  },
  assetsUrl:  config.assetsUrl,
  allowedConnections: ['company-a', 'company-b', 'company-c], //this doesn't seem to work
  rememberLastLogin: !prompt,
  language: language,
  languageDictionary: languageDictionary,
  theme: {
    logo:            'http://www.mydomain.co/img/logo.png',
    primaryColor:    'purple'
  },
  prefill: loginHint ? { email: loginHint, username: loginHint } : null,
  closable: false,
  // uncomment if you want small buttons for social providers
  // socialButtonStyle: 'small'
});

lock.show();

Prashant Trivedy Prashant Trivedy · Accepted Answer · 2019-03-26T11:23:12

When your question was posted, app_metadata could not be searched. Now, however, app_metadata is searchable via the Management API User Search endpoint using search_engine v3.

Based on this, the easiest way to implement this would be to stick with a single connection, while storing tenant information in app_metadata. You could then perform a user search based on the metadata attribute, e.g. app_metadata.tenant_name:"Tenant1".

If you prefer to stick with multiple database connections, Lock now supports a connectionResolver option, which could be used to decide which connection to authenticate the user with based on some custom logic, for example, the entered email address. The following documentation outlines this in further detail: https://auth0.com/docs/libraries/lock/v11/selecting-the-connection-for-multiple-logins#selecting-among-multiple-database-connections

Auth0 multi-tenant architecture - Multiple Database connections

1 Answers