Hi Team,
We are currently using Auth0 Classic Login with customized Auth0 Lock to support different authentication methods based on the connection.
| Region | Enterprise Connection | Database Connection | Social Account |
|---|---|---|---|
| US | O365/GW | custom-db | Sharp Start |
| EU | O365/GW | custom-db | Cloud Portal |
| JP | O365/SMJ | custom-db1, custom-db2 | — |
Separate Auth0 tenants are used for each stack.
Current Security Concern:
With Classic Login, connection/domain discovery is handled on the client side. The Auth0 API response contains available domains/connections, which means users can potentially see customer domain and connection information that is not relevant to them.
To address this, we are moving from Classic Login to Auth0 New Universal Login with Identifier-First. With this approach, Home Realm Discovery (HRD) is handled by Auth0 on the server side, rather than exposing the domain/connection information to the client.
Connection Handling Requirements
We have two scenarios that need to be supported with Auth0 New Universal Login.
- Same email address in Enterprise and Database connections
The same email address/domain may be associated with both an Enterprise connection and an Auth0 Database connection.
For example:
user@company.com → Enterprise / O365
user@company.com → Database / custom-db
Note: In US case, we will have 1000’s of connections registered under each enterprise connection so I cannot enable Display connection as a button in login experience.
Can New Universal Login support this scenario and allow the user to select the appropriate authentication method?
- Multiple Database connections in JP
Our JP tenant has two Database connections:
Customer Login → custom-db1
Service User Login (SLER) → custom-db2
Can New Universal Login support multiple Database connections in the same application? If so, how can Auth0 determine or select the appropriate Database connection?
Question:
Can New Universal Login support both of these scenarios while keeping the connection/domain selection on the Auth0 side, without implementing client-side HRD?
If yes, what is the recommended Auth0 configuration or approach to achieve this?