Hi all. I’m trying to prevent user creation if user is not whitelisted with rules. I have 2 rules in effect: domain whitelist & individual emails. I’m using social login (Google). [image] Auth0 IP Addresses for Allow Lists Lists Auth0 IP addresses for use in allow lists for inbound tra…

Oh, I see the Google mention now! :upside_down_face: Yes, only rules will cover all connections. Usually, you’d just throw an authorization error like you’ve already mentioned. The user would be created, though. Here’s how you could delete the user: Create a M2M application: [Screen Shot 2021-…

Hi @vainkop , That is correct about rules. By the time rules run, the user is already created in the system, so the rule would have to actually delete the user which would add complexity. In a pre-registration hook, you could prevent the user from signing up like this: module.exports = function (u…

@stephanie.chamblee sorry but my question is explicitly talking about using the social login with Google so please tell me how can I prevent user creation in User Management → Users section of Auth0 if I’m using google-oauth2 to authenticate users? If the use of rule which deletes user after creati…

@stephanie.chamblee Thank you for your answer I will try that! But honestly that looks more like a development of the Auth0 platform itself & a workaround than just using it :slight_smile: Auth0 is basically allowing to create users without authorization so theoretically if someone has a lot of so…

Unfortunately, there is not a simple way to prevent user creation with a social connection. The recommended approach is throwing an authorization error in a rule. The above approach is one way to implement what you need, but it is true that it is not simple. It’d be great to have your use case in a…

I don’t think that it’s correct to determine that situation as just “not easy to implement” That looks like a security hole in the platform which can be temporarily covered with a workaround but I’m not sure how can Auth0 pass a serious security audit with that. If I was building a really serious …

Also your workaround cannot be used by some clients & logins by external unauthorized google accounts can easily exhaust the number of api calls per month which is also a ddos: This feature is included in your current plan up to 1,000 calls per month: upgrade your subscription to [Developer Pro] o…

Thanks for the feedback @vainkop ! It’d be great to get this input in the feedback category so that this can be evaluated by the product team. It looks like the Dynamic Client Registration feature is based on the open Dynamic Registration outlined in the OpenID Connect Dynamic Client Registration sp…

[image] Prevent social (Google) user creation in Auth0 UI if user is not whitelisted + documentation + api rate limit Feedback Basic functionality like user or domain whitelisting should not require the use of rules + js code. That’s usually too hard for a regular user & i…

Prevent user creation (with hook?) if user is not whitelisted with rule

Get Help

vainkop April 30, 2021, 4:25pm 11

Topic		Replies	Views
Prevent user to be added on Dashboard if rules throw error Get Help rules	4	4129	May 22, 2020
Prevent social (Google) user creation in Auth0 UI if user is not whitelisted + documentation + api rate limit Product Feedback auth0 , api , management-api , login , security	1	3307	April 30, 2021
Limiting Social Signups Get Help social-connections , rules	7	2732	October 21, 2020
Using pre registration Hooks to prevent duplicate account creation Get Help hooks	6	5966	November 1, 2019
Registration flow with external system Get Help user-management , user-already-exists	3	297	March 27, 2024

Prevent user creation (with hook?) if user is not whitelisted with rule

Related topics