Auth0 Tenant Access Control List (ACL) Use Case Examples

Tenant Access Control List (ACL) rules provide granular control over network-level access to an Auth0 tenant. Administrators can configure these rules to evaluate incoming requests based on conditional properties, scopes, and actions. The decision logic relies on a range of signals provided by Auth0, allowing for precise access control based on the origin and characteristics of incoming requests.

• Auth0
• Tenant Access Control List (ACL)

What are the components of a Tenant ACL rule?

Review the following components to understand how a Tenant ACL rule evaluates incoming requests and triggers actions.

• Conditional Property: The rule evaluates based on a match or not_match condition. The match property applies the rule when the specified condition is true for the request. The not_match property applies the rule only when the condition does not match.
• Scope: Rules apply to requests targeting different scopes, including management, authentication, tenant, and dynamic_client_registration.
• Action: When a condition is met, the rule triggers an action, such as block, allow, redirect, redirect_uri, or log.

Block Management API Access From Known Malicious IP Addresses

Configure the Tenant ACL to block up to 10 IP addresses with a single rule by applying the following JSON snippet.

{
  "description": "Block Management API Access from Known Malicious IPs",
  "active": true,
  "priority": 1,
  "rule": {
    "match": {
      "ipv4_cidrs": [
        "111.111.111.111/32",
        "222.222.222.222/32"
      ]
    },
    "scope": "management",
    "action": {
      "block": true
    }
  }
}

Configure the Tenant ACL to allow specific IP addresses and block all others by applying multiple rules in the following JSON snippet.

[
  {
    "description": "Allow known IP addresses",
    "active": true,
    "priority": 1,
    "rule": {
      "match": {
        "ipv4_cidrs": [
          "111.111.111.111/32",
          "111.111.111.222/32"
        ]
      },
      "scope": "management",
      "action": {
        "allow": true
      }
    }
  },
  {
    "description": "Allow known IP addresses",
    "active": true,
    "priority": 2,
    "rule": {
      "match": {
        "ipv4_cidrs": [
          "111.111.222.111/32",
          "111.111.222.222/32"
        ]
      },
      "scope": "management",
      "action": {
        "allow": true
      }
    }
  },
  ...,
  {
    "description": "Allow known IP addresses and block any others",
    "active": true,
    "priority": 10,
    "rule": {
      "not_match": {
        "ipv4_cidrs": [
          "111.111.000.111/32",
          "111.111.000.222/32"
        ]
      },
      "scope": "management",
      "action": {
        "block": true
      }
    }
  }
]

NOTE: The final rule in the multiple-rule configuration uses the block action and the not_match condition.

How is traffic redirected based on country location?

Redirect users from a specific country to a designated policy page by applying the following JSON snippet.

 {
  "description": "Redirect German users to policy page",
  "active": true,
  "priority": 20,
  "rule": {
    "action": {
      "redirect": true,
      "redirect_uri": "https://example.com/restrictions"
    },
    "match": {
      "geo_country_codes": ["DE"]
    },
    "scope": "tenant"
  }
}

Configure Rules Based on Specific Scopes

Apply the following JSON snippets to configure rules that target specific scopes, such as allowing VPN access, permitting regional authentication, or redirecting regional traffic.

Allow Canadian VPN access to the Management API by applying this configuration.

 {
  "description": "Allow Canadian VPN access to management API",
  "active": true,
  "priority": 10,
  "rule": {
    "action": { "allow": true },
    "match": {
      "ipv6_cidrs": ["2002:7bcd:/32"]
    },
    "scope": "management"
  }
}
 

Allow traffic from a specific country to access the Authentication scope by applying this configuration.

{
  "description": "Allow access to authentication API from France",
  "active": true,
  "priority": 10,
  "rule": {
    "action": { "allow": true },
    "match": {
      "geo_country_codes": ["FR"]
    },
    "scope": "authentication"
  }
}

Redirect United States traffic to a US-based Auth0 tenant by applying this configuration.

{
  "description": "Redirect US users to US tenant",
  "active": true,
  "priority": 5,
  "rule": {
    "action": {
      "redirect": true,
      "redirect_uri": "https://us.example-tenant.com/login"
    },
    "match": {
      "geo_country_codes": ["US"]
    },
    "scope": "authentication"
  }
}