Skip to content
Rules are code snippets written in JavaScript that are executed as part of the authentication pipeline in Auth0
Branch: master
Clone or download
Latest commit 4e67aab May 11, 2019

Auth0 Rules Repository


Rules are code snippets written in JavaScript that are executed as part of the authentication pipeline in Auth0. This happens every time a user authenticates to an application. Rules enable very powerful customizations and extensions to be easily added to Auth0.

An App initiates an authentication request to Auth0 (Step 1), Auth0 routes the request to an Identity Provider through a configured connection (Step 2). The user authenticates successfully (Step3), the user object that represents the logged in user is then passed through the rules pipeline and returned to the app (Step 4).

A rule will run on Step 4 and this is the information each rule will get:

  • user: the user object as it comes from the identity provider.
  • context: an object containing contextual information of the current authentication transaction. It has the following properties:
    • clientID: the client id of the application the user is logging in to.
    • client_metadata: an optional object containing up to 10 key/value pairs
    • clientName: the name of the application (as defined on the dashboard).
    • connection: the name of the connection used to authenticate the user (e.g.: twitter or some-google-apps-domain)
    • connectionStrategy: the type of connection. For social connection connectionStrategy === connection. For enterprise connections, the strategy will be waad (Windows Azure AD), ad (Active Directory/LDAP), auth0 (database connections), etc.
    • protocol: the authentication protocol. Possible values: oidc-basic-profile (most used, web-based login), oidc-implicit-profile (used on mobile devices and single page apps), oauth2-resource-owner (user/password login typically used on database connections), samlp (SAML protocol used on SaaS apps), wsfed (Ws-Federation used on Microsoft products like Office365), wstrust-usernamemixed (Ws-trust user/password login used on CRM and Office365)), delegation (during the exchange for a delegation token).
    • request: an object containing useful information of the request. It has the following properties:
      • query: querystring of the login transaction sent by the application
      • body: the body of the POST request on login transactions used on oauth2-resource-owner or wstrust-usernamemixed protocols.
      • userAgent: the user-agent of the client that is trying to log in.
      • ip: the originating IP address of the user trying to log in.
    • samlConfiguration: an object that controls the behavior of the SAML and WS-Fed endpoints. Useful for advanced claims mapping and token enrichment (only available for samlp and wsfed protocol).

Note that rules will also have access to several modules defined globally, including auth0, referring to Other modules available within rules are defined at (relevant to both appliance and cloud)

This is the rules editor inside Auth0:

Available Modules

Release Notes

  1. Update the markdown files to update the rule and commit your changes
  2. Update the version by executing:
npm version [patch|minor|major]

There is a preversion script in the package.json file that executes the following command: ./build && git add rules.json && git commit -m 'update rules.json

  1. Push your changes to master including the tags
git push origin master --tags

Highlighted Rules

  • Send events to MixPanel Docs | Rule
  • Query User Profile in FullContact Docs | Rule
  • Add a Lead in Salesforce Docs | Rule
  • Get an Appery Session Token Rule

More information about them here.

Issue Reporting

If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.




This project is licensed under the MIT license. See the LICENSE file for more info.

You can’t perform that action at this time.