B2B via Connections

Use this when each external customer maps to its own enterprise connection (a SAML or OIDC connection to their IdP, for example) instead of an Auth0 Organization. A user’s tenant membership follows which connection they authenticated through, and which groups their IdP put them in via SCIM. This is an alternative to B2B via Organizations: no Auth0 Organization is involved anywhere in this model. A connection is the organization boundary here: a user reaches it either directly, or through a SCIM group that belongs to it.

Model

Mapping

version: "1"

rules:
  - name: "Link user to connection"
    when: >-
      (input.type == "user.created" || input.type == "user.updated") &&
      input.data.context?.connection?.id != nil
    variables:
      user_id: input.data.object.user_id
      connection_id: input.data.context.connection.id
    tuples:
      - user: "user:{{ variables.user_id }}"
        relation: "member"
        object: "connection:{{ variables.connection_id }}"

  - name: "Link group to connection on creation"
    when: input.type == "group.created"
    variables:
      group_id: input.data.object.id
      connection_id: input.data.object.connection_id
    tuples:
      - user: "connection:{{ variables.connection_id }}"
        relation: "connection"
        object: "group:{{ variables.group_id }}"
      - user: "group:{{ variables.group_id }}#member"
        relation: "member"
        object: "connection:{{ variables.connection_id }}"

  - name: "Add user member to group"
    when: >-
      input.type == "group.member.added" &&
      input.data.object.member.member_type == "user"
    variables:
      group_id: input.data.object?.group?.id
      member_id: input.data.object?.member?.id
    tuples:
      - user: "user:{{ variables.member_id }}"
        relation: "member"
        object: "group:{{ variables.group_id }}"

  - name: "Remove user member from group"
    when: >-
      input.type == "group.member.deleted" &&
      input.data.object.member.member_type == "user"
    variables:
      group_id: input.data.object?.group?.id
      member_id: input.data.object?.member?.id
    tuples:
      - action: delete
        user: "user:{{ variables.member_id }}"
        relation: "member"
        object: "group:{{ variables.group_id }}"

  - name: "Revoke all group tuples on deletion"
    when: >-
      input.type == "group.deleted" &&
      input.data.object?.id != nil
    variables:
      group_id: input.data.object.id
    tuple_filters:
      - object: "group:{{ variables.group_id }}"
        action: delete
      - object: "group:"
        user: "group:{{ variables.group_id }}#member"
        action: delete
      - object: "connection:"
        user: "group:{{ variables.group_id }}#member"
        action: delete

tests:
  - name: "user.created with connection context writes direct connection member"
    input:
      type: "user.created"
      data:
        object:
          user_id: "u_alice"
        context:
          connection:
            id: "con_acme_saml"
    expect_tuples:
      - user: "user:u_alice"
        relation: "member"
        object: "connection:con_acme_saml"

  - name: "user.created without connection context writes nothing"
    input:
      type: "user.created"
      data:
        object:
          user_id: "u_alice"
    expect_tuples: []

  - name: "group.created links group to connection and grants member access"
    input:
      type: "group.created"
      data:
        object:
          id: "grp_acme_eng"
          connection_id: "con_acme_saml"
    expect_tuples:
      - user: "connection:con_acme_saml"
        relation: "connection"
        object: "group:grp_acme_eng"
      - user: "group:grp_acme_eng#member"
        relation: "member"
        object: "connection:con_acme_saml"

  - name: "group.member.added adds a user member"
    input:
      type: "group.member.added"
      data:
        object:
          group:
            id: "grp_acme_eng"
          member:
            member_type: "user"
            id: "u_bob"
    expect_tuples:
      - user: "user:u_bob"
        relation: "member"
        object: "group:grp_acme_eng"

  - name: "group.member.deleted removes a user member"
    input:
      type: "group.member.deleted"
      data:
        object:
          group:
            id: "grp_acme_eng"
          member:
            member_type: "user"
            id: "u_bob"
    expect_tuples:
      - user: "user:u_bob"
        relation: "member"
        object: "group:grp_acme_eng"
        action: delete

  - name: "group.deleted revokes all group tuples"
    input:
      type: "group.deleted"
      data:
        object:
          id: "grp_acme_eng"
    expect_tuples: []
    expect_tuple_filters:
      - object: "group:grp_acme_eng"
        action: delete
      - object: "group:"
        user: "group:grp_acme_eng#member"
        action: delete
      - object: "connection:"
        user: "group:grp_acme_eng#member"
        action: delete

connection#member accepting group#member (alongside user) is what lets a user reach the connection either directly or through a SCIM group, with the same relation either way. “Link group to connection on creation” writes both the bookkeeping group --connection--> connection tuple (which connection owns this group) and the group#member --member--> connection tuple that actually grants every group member connection membership. With that in place, a Check for user#member@connection resolves true for a user added directly and for a user added to any group on that connection, and false for a user who was never added to either.

Auth0’s event schema for user.created and user.updated only requires context.tenant, so context.connection is optional and can be absent. Don’t rely on it to identify the connection. Read data.object.identities[].connection instead, which the schema always includes; it holds the connection’s name, not its ID, and is paired with that identity’s user_id.

Known limitations

Connection deletion isn’t handled above. connection.deleted exists as an event, but this mapping doesn’t clean up a user’s direct connection membership or a group’s connection tuple on deletion; add a tuple_filters rule modeled on “Revoke all group tuples on deletion” if you need this.
Roles. There’s no per-user role assignment tied to a plain connection. If you need roles here, assign them to the SCIM group itself; see Roles: a group, at the tenant level.

Introduction to Auth0 FGA

Permissions Index

FGA Dashboard

Define your authorization model

Write Your Authorization Data

Add Authorization To Your API

Auth0 Relationship Sync

Advanced Modeling

Deprecation Notices & Migrations

Model

Mapping

Known limitations

​Model

​Mapping

​Known limitations

Model

Mapping

Known limitations