About Auth0 Actions redirects
Auth0 has no built-in “add an external identity provider as an authentication factor” setting that Persona can connect to with only configuration. The equivalent in Auth0 is the Redirect with Actions capability of the Auth0 Actions extensibility framework. A post-login Action can stop a login for a time and send the user to a third-party page, for example a Persona verification. When the user comes back, the Action continues the login.
When you add Persona this way, your Auth0 administrator can require a live identity verification, for example a selfie check. The user must complete it before a password reset or before access to a sensitive resource. This helps to protect your users against social engineering, deepfakes, and account takeover at the most important moments.
This article gives high-level guidance and links to the Auth0 documentation. It does not give a full click-by-click procedure. It uses the general-purpose extensibility framework of Auth0, not a Persona-specific setting. Thus, the implementation is specific to your tenant. For the details, use the Auth0 documentation.
Auth0 Configuration Guide
1. Prepare your Persona inquiry template
In the Persona Dashboard, create or select the inquiry template for the verification that you want to require, for example a government ID and selfie check. Your Action sends the user to a page. That page starts an inquiry from this template, for example through a hosted flow link.
2. Write a post-login Action
To use Persona as a step-up factor, write a post-login Action. At a high level, the Action does these steps:
- Checks
event.authentication.methodsfor a record that shows that the user recently completed the Persona factor. If there is no record, it callsapi.redirect.sendUserTo(). This stops the login for a time and sends the user to a page that starts a Persona inquiry. - After the user completes the inquiry, sends the user back to the Auth0
/continueendpoint to continue the login. - In the
onContinuePostLoginhandler, callsapi.authentication.recordMethod()to record that the custom factor is complete. This is the only handler where this call is permitted. Thus, later logins in the same session do not start the factor again when it is not necessary.
Use the Auth0 Management API to write verification results to the user record, for example to app_metadata. Do not use front-channel query parameters for the results, because a user can change them in the browser.
This path is fully custom code that runs in your tenant. Thus, before you implement it, read all of the Auth0 Redirect with Actions documentation. This includes its notes about how a redirect interacts with prompt=none silent authentication and refresh tokens.
3. Configure Persona Marketplace Integration for Employee Data
Persona needs API access to your Auth0 tenant to compare the verification result with the Auth0 profile of the user. The Persona Auth0 Marketplace integration can get and update Auth0 users from a Persona Workflow. Use that guide to add your Auth0 credential in the Persona Dashboard.
Related resources
- Auth0 integration overview
- Using Persona Workflows to manage Auth0 users & profiles
- Auth0: Redirect with Actions
- Auth0: Management API
Plans Explained
Auth0 Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Auth0 Integration | Not Available | Not Available | Limited | Available |