Auth0

Overview

The EQTY Governance Platform integrates with Auth0 for user authentication and authorization.

Required Auth0 applications:

Platform API (M2M) – Machine-to-machine app for backend API token validation
Auth Service Backend (M2M) – Machine-to-machine app for user management via Auth0 Management API
Governance Studio (SPA) – Single Page Application for frontend authentication

This guide covers:

Creating Auth0 applications (Auth0 CLI or Dashboard)
Configuring API permissions and scopes
Setting up organization support for multi-tenancy
Configuring the Helm chart for Auth0

Prerequisites

Auth0 tenant (sign up at auth0.com if needed)
Auth0 CLI installed (for CLI method)
Auth0 tenant domain (e.g. your-tenant.us.auth0.com)

Helm Configuration

Add the following to the values.yaml and secrets.yaml files. Placeholders will be filled in throughout the steps below.

values.yaml:

auth-service:
  config:
    idp:
      provider: "auth0"
      issuer: "https://<auth0-domain>/" # Filled in after step 1
      auth0:
        domain: "<auth0-domain>" # Filled in after step 1
        managementAudience: "https://<auth0-domain>/api/v2/" # Filled in after step 1
        apiIdentifier: "<api-identifier>" # Filled in after step 6

governance-service:
  config:
    authProvider: "auth0"
    auth0Domain: "<auth0-domain>" # Filled in after step 1

governance-studio:
  config:
    authProvider: "auth0"
    auth0Domain: "<auth0-domain>" # Filled in after step 1
    auth0ClientId: "<spa-client-id>" # Filled in after step 4
    auth0Audience: "https://<auth0-domain>/api/v2/" # Filled in after step 1

secrets.yaml:

global:
  secrets:
    create: true
    auth:
      provider: "auth0"
      auth0:
        secretName: "platform-auth0"
        values:
          clientId: "<platform-api-client-id>" # Filled in after step 2
          clientSecret: "<platform-api-secret>" # Filled in after step 2
          mgmtClientId: "<auth-service-client-id>" # Filled in after step 3
          mgmtClientSecret: "<auth-service-secret>" # Filled in after step 3

Quick Start (CLI Method - Recommended)

1. Install and Authenticate Auth0 CLI

Install the Auth0 CLI:

# macOS
brew install auth0/auth0-cli/auth0

# Linux
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh

Authenticate with the Auth0 tenant:

auth0 login

Note the tenant domain shown after login (e.g. your-tenant.us.auth0.com).

Update values.yaml with the tenant domain.

values.yaml -> auth-service.config.idp:

issuer: "https://<auth0-domain>/"
auth0:
  domain: "<auth0-domain>"
  managementAudience: "https://<auth0-domain>/api/v2/"

values.yaml -> governance-service.config:

auth0Domain: "<auth0-domain>"

values.yaml -> governance-studio.config:

auth0Domain: "<auth0-domain>"
auth0Audience: "https://<auth0-domain>/api/v2/"

2. Create Platform API (M2M Application)

auth0 apps create \
  --name "EQTY Platform API" \
  --type m2m \
  --description "Backend API for EQTY Governance Platform token validation" \
  --reveal-secrets

The output will look like:

=== your-tenant.us.auth0.com application created

 CLIENT ID      abc123def456
 NAME           EQTY Platform API
 TYPE           Machine to Machine
 CLIENT SECRET  your-client-secret-here

Save both the Client ID and Client Secret.

Update secrets.yaml with the Platform API credentials.

secrets.yaml -> global.secrets.auth.auth0.values:

clientId: "<platform-api-client-id>"
clientSecret: "<platform-api-client-secret>"

3. Create Auth Service Backend (M2M Application)

auth0 apps create \
  --name "EQTY Auth Service Backend" \
  --type m2m \
  --description "User management for EQTY Governance Platform" \
  --reveal-secrets

Save both the Client ID and Client Secret.

Grant the required Management API permissions. Replace <auth-service-client-id> with the Client ID from above:

auth0 api post /api/v2/client-grants \
  --data '{
    "client_id": "<auth-service-client-id>",
    "audience": "https://<auth0-domain>/api/v2/",
    "scope": ["read:users", "update:users", "create:users", "read:organizations", "update:organizations", "create:organizations"]
  }'

Update secrets.yaml with the Auth Service Backend credentials.

secrets.yaml -> global.secrets.auth.auth0.values:

mgmtClientId: "<auth-service-client-id>"
mgmtClientSecret: "<auth-service-client-secret>"

4. Create Governance Studio SPA

Replace <domain> with the governance platform domain (e.g. governance.example.com):

auth0 apps create \
  --name "EQTY Governance Studio" \
  --type spa \
  --description "Frontend SPA for EQTY Governance Platform" \
  --callbacks "https://<domain>/callback,http://localhost:3000/callback" \
  --logout-urls "https://<domain>,http://localhost:3000" \
  --web-origins "https://<domain>,http://localhost:3000" \
  --reveal-secrets

Save the Client ID from the output.

Update values.yaml with the SPA client ID.

values.yaml -> governance-studio.config:

auth0ClientId: "<spa-client-id>"

5. Configure for Business Users (Organizations)

Enable organizations on the SPA to support multi-tenancy. Replace <spa-client-id> with the Client ID from step 4:

auth0 apps update <spa-client-id> \
  --organization-usage required \
  --organization-require-behavior "pre_login_prompt"

6. Create an API Definition

Replace <domain> with the governance platform domain:

auth0 apis create \
  --name "EQTY Governance Platform API" \
  --identifier "https://<domain>" \
  --scopes "governance:declarations:create,governance:declarations:read,integrity:statements:create"

Update values.yaml with the API identifier.

values.yaml -> auth-service.config.idp.auth0:

apiIdentifier: "https://<domain>"

Alternative: Web UI Setup

Click to expand Auth0 Dashboard instructions

Using the Auth0 Dashboard

1. Create Platform API Application

Navigate to Applications > Applications in Auth0 Dashboard
Click “Create Application”
Name: “EQTY Platform API”
Type: Machine to Machine Applications
Save the Client ID and Client Secret

Update secrets.yaml with the Platform API credentials.

secrets.yaml -> global.secrets.auth.auth0.values:

clientId: "<platform-api-client-id>"
clientSecret: "<platform-api-client-secret>"

2. Create Auth Service Backend Application

Create another M2M application: “EQTY Auth Service Backend”
Authorize it to call the Auth0 Management API
Grant scopes: read:users, update:users, create:users, read:organizations, update:organizations, create:organizations
Save the Client ID and Client Secret

Update secrets.yaml with the Auth Service Backend credentials.

secrets.yaml -> global.secrets.auth.auth0.values:

mgmtClientId: "<auth-service-client-id>"
mgmtClientSecret: "<auth-service-client-secret>"

3. Create Governance Studio SPA

Create a Single Page Application: “EQTY Governance Studio”
Configure callbacks, logout URLs, and web origins with the governance platform domain
Change the application’s login experience to “Business Users”
Save the Client ID

Update values.yaml with the domain and SPA client ID.

values.yaml -> auth-service.config.idp:

issuer: "https://<auth0-domain>/"
auth0:
  domain: "<auth0-domain>"
  managementAudience: "https://<auth0-domain>/api/v2/"

values.yaml -> governance-service.config:

auth0Domain: "<auth0-domain>"

values.yaml -> governance-studio.config:

auth0Domain: "<auth0-domain>"
auth0ClientId: "<spa-client-id>"
auth0Audience: "https://<auth0-domain>/api/v2/"

4. Create API Definition

Navigate to Applications > APIs
Create API with identifier: https://<domain>
Define scopes as needed

Update values.yaml with the API identifier.

values.yaml -> auth-service.config.idp.auth0:

apiIdentifier: "https://<domain>"

Verification

Verify the OIDC discovery endpoint:

curl "https://<auth0-domain>/.well-known/openid-configuration" | jq .

Test token issuance with Platform API credentials:

curl -X POST "https://<auth0-domain>/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "<platform-api-client-id>",
    "client_secret": "<platform-api-client-secret>",
    "audience": "https://<domain>",
    "grant_type": "client_credentials"
  }' | jq .

If both commands succeed and return valid JSON, the Auth0 configuration is correct.

Security Best Practices

Rotate Secrets: Regularly rotate client secrets and update Kubernetes secrets
Least Privilege: Only grant the Management API scopes required (read:users, update:users, create:users, read:organizations, update:organizations, create:organizations)
Organizations: Use Auth0 Organizations for tenant isolation in multi-tenant deployments
Monitor Activity: Enable Auth0 log streaming to monitor authentication events and detect anomalies

Auth0

Overview

Prerequisites

Helm Configuration

Quick Start (CLI Method - Recommended)

1. Install and Authenticate Auth0 CLI

2. Create Platform API (M2M Application)

3. Create Auth Service Backend (M2M Application)

4. Create Governance Studio SPA

5. Configure for Business Users (Organizations)

6. Create an API Definition

Alternative: Web UI Setup

Using the Auth0 Dashboard

1. Create Platform API Application

2. Create Auth Service Backend Application

3. Create Governance Studio SPA

4. Create API Definition

Verification

Security Best Practices

Official Documentation