Redirect Blocked Users to a Custom Error Page Using Rules or Actions

Knowledge Articles
, , ,
1

Last Updated: Nov 25, 2024

Overview

An Auth0 Admin has blocked a user via the Auth0 dashboard, which adds the attribute blocked:true to the user’s profile. After authenticating, this user should get redirected by a Rule or Action to a custom error page. However, it’s been noticed that the Rule or Action does not execute when the user attempts to log in.

Applies To

  • Blocked User
  • Rules
  • Actions
  • Redirects

Cause

Blocks applied by tenant admins (blocked:true in user profile) will not trigger extensibility flows.

Solution

There is no extensibility point to catch users that are blocked (i.e. {“blocked”:true} in the user’s profile). This type of block skips all Rule/Action codes.

Currently, this would need to be handled on the Service Provider’s side. Upon receiving the “user is blocked” response, it would need to be able to parse this and display the error message or redirect the user to a page on the application that can show the desired message to them.

An alternative would be not to use the built-in block status and implement a custom blocked flag in the user’s app_metadata. This would allow the “blocked” user to initially be allowed to log in and trigger the extensibility flows, and then they could be redirected to a custom page or pass an unauthorized error to the callback URL before they obtain any tokens.

NOTE: When attempting this pattern, it is necessary to use a name for that custom blocked flag that does not conflict with other Auth0 root profile attribute names to avoid unexpected behavior.

e.g. For redirecting to a custom page, setting this in the user’s app_metadata: “custom_block”:true, and then having the following Rule:

function(user, context, callback){
  user.app_metadata = user.app_metadata || {};
  const custom_block = user.app_metadata.custom_block || false; //default to false if not set
  if (custom_block){
    // redirect users with custom block status true
    context.redirect = {
      url: "https://example.com/custom_block"
    };
  }
    return callback(null, user, context);
    
}

The following Action sample will also achieve the same behavior:

exports.onExecutePostLogin = async (event, api) => {
  event.user.app_metadata = event.user.app_metadata || {};
  let custom_block = event.user.app_metadata.custom_block || false;

  if (custom_block) {
    let token = api.redirect.encodeToken({
      secret: "mysecret",
      payload:{
        email: event.user.email
      }
    });

    api.redirect.sendUserTo("https://example.com/custom_block", {
      query: {token}
    });
  }
};

This will redirect the user to the configured URL with a querystring value.