We use email addresses as unique user identifiers, so we’d like to normalize them, mostly to keep users from confusing themselves or their co-workers. Since we can’t normalize the address that users enter before it is passed to Auth0, what normalization does Auth0 perform?
Presumably the domain part is lower-cased, as it’s case-insensitive. Usually, the part before the @ is lower-cased as well, though the RFC allows it to be case-sensitive. More importantly, there can be comments following a plus sign (or using parentheses?), and Google email addresses canonically remove dots.
That is, I’m most concerned with the guy who uses both JohnDoe@gmail.com and john.doe@google.com and doesn’t realize he’s using two addresses, because they wind up in the same inbox.