Auth0 SSO
Connect Auth0 SSO to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Auth0 SSO to collect identity & sso evidence automatically.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In Auth0 SSO:
- In the Auth0 Dashboard, go to Applications › Applications and click Create Application.
- Enter a descriptive name, select Machine to Machine Applications, and click Create.
- Select the API to call (the Auth0 Management API), select under Permissions only the read permissions read:users, read:guardian_factors, read:roles, read:connections and read:attack_protection, and click Authorize.
- Open the new application and select the Credentials tab, which shows the application's authentication method and configured credentials.
Where to find the other values:
- Management API token (optional): Optional stopgap: go to Applications › APIs › Auth0 Management API, select the API Explorer tab, and click the Copy icon in the Token section. It expires after 86400 seconds (24 hours) by default and cannot be revoked.
Auth0 SSO's public documentation does not cover every step.
Auth0 warns to use the update:client_grants and create:client_grants scopes only with high-privileged applications. The fetched pages do not name the Domain, Client ID or Client Secret fields or say whether the secret can be viewed again. The Management API Explorer token is for testing, lasts 24 hours by default and cannot be revoked; prefer the M2M client credentials.
-
On Compliance › Connectors, open Auth0 SSO, click Connect, choose API token and fill in:
Field What to enter Auth0 domain Required. M2M client ID Required. Create an Application of type Machine to Machine, authorized for the Auth0 Management API. M2M client secret Required. Read-only scopes are enough: read:users, read:guardian_factors, read:roles, read:connections, read:attack_protection. Stored encrypted and never shown again. Management API token (optional) Stopgap only: Auth0 management tokens expire after 24 hours and collection then stops. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Auth0 SSO and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3, CC6.6, CC7.2 | 12 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.5, A.8.15, A.8.16 | 12 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(a)(1), 164.312(b), 164.312(d) | 12 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.1, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.2, 10.5.1, 11.5.1 | 12 |
| NIST CSF 2.0 | Automated tests | DE.CM-03, PR.AA-01, PR.AA-03, PR.AA-05, PR.PS-04 | 12 |
These tests are switched on per workspace by the Safeguard team.
Auth0 connect to the same provider as Auth0 SSO, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks