We recently stood up Auth0 as the user authentication component in front of a 3rd party, cloud-based product. We are now looking to integrate with another 3rd party application, and I suspect this pattern will continue. As well, we have a few of our own in-house apps we’d like to refactor to use sessions per Auth0. Our primary goal is that of allowing the same account/session to authenticate with all our various apps.
Originally, we were thinking we would only use Auth0 for identify, but it seems Auth0 can handle user profile data, too. One of the 3rd party platforms we’re using has a push API for updating user profiles within its system, and I’m confident we can create similar endpoints on our various in-house apps. So what I am looking for is a bit of validation that the following would be a feasible way to integrate our various systems… leveraging our modest-sized, 3 person development team.
- Use post user-registration webhook to push user data to our various apps / 3rd party platforms
- Create profile management interface from our primary web app for users to self-manage their user profile (using patch_users_by_id)
- Persist data we are allowing the user to change within the Auth0 user_metadata field
- Persist app-specific data within the Auth0 app_metadata field
- Establish cronjob to push user data updates to our various apps / 3rd party platforms on schedule (daily/hourly as needed)
Does this seem like a sane implementation? Is there something you might suggest we do differently or that we’re overlooking entirely? We appreciate any best practices and/or conventions you can recommend!