Rule Use Cases

The following is a list of Rules for implementing a variety of functionality in Auth0.

Before proceeding, please review our best practice recommendations for working with Rules. Also, see our security bulletin regarding vulnerable patterns when working with custom rules code.

• Change the returned scopes of the Access Token and/or add claims to it (and the ID Token)

• Set the JWT ID (JTI) of an Access Token

• Sample Use Cases - Rules with Authorization

• Sample Use Cases - Rules with Passwordless Authentication

• Customize Email Handling: Send verification email

• Customize Email Handling: Send welcome email

• Use Rules with the Authorization Extension

• Add user roles to the Delegated Administration Extension namespace in the ID Token

• Map an AWS role to an IAM policy that enforces access rules for AWS resources

• Provision/log users in from Azure Active Directory

• Modify SAML configuration to store user's group memberships

• Integrate with MixPanel Product Analytics

• Integrate with Enterprise Fraud Management Solutions

• Integrate with eCommerce and Retail Fraud Management Solutions

• Integrate with Salesforce Customer Relationship Management Solutions

• Integrate with HubSpot Marketing Software

• Integrate with MaxMind minFraud

• Automatically Generate Leads in Shopify

• Integrate User ID Verification Services Using Rules

• Disable login for flagged users

• Record sign up events for your Auth0 apps in Keen, Segment, or Splunk

• Track new leads in Salesforce by gathering TowerData information and adding it to user profiles, then recording the sign up as a new lead in Salesforce

• Track new signups in Salesforce by recording a sign up event in MixPanel, augmenting user profiles with information from FullContact, and recording the sign up as a new lead in Salesforce

• Define the conditions that trigger additional authentication challenges when users log in

• Require users to log in with Duo every time

• Require users to authenticate with MFA whenever a specific scope is requested

• Require users to authenticate with MFA whenever requested by the web app

• Customize your SAML responses

• Change the signing key for SAML responses

• Validate token scopes

• Add missing user profile information from secondary identities

• Deny User Access to an API with Rules