Impact of Deleting a Role Associated With Millions of Users in Auth0
Last Updated:
Overview
Auth0 safely deletes a role associated with millions of users without causing errors or delays in Universal Login or APIs. However, because Auth0 cannot revoke active Access Tokens, the permissions associated with the deleted role remain active until the token expires. Mitigate this delay by requiring users to log out and log back in or by revoking Auth0 sessions.
Applies To
- Auth0
- Roles
- Access Tokens
- Refresh Tokens
Solution
What is the impact of deleting a widely assigned role in Auth0?
Auth0 safely deletes a role associated with millions of users without causing errors or delays in Universal Login or APIs. However, Auth0 cannot revoke active Access Tokens. The permissions associated with the deleted role remain active until the Access Token expires.
How is the delay in permission updates mitigated?
Minimize the time lag between role deletion and fetching a new Access Token, implement the following strategies:
- Keep the Access Token lifetime short.
- Require users to log out and log back in to fetch a new Access Token (and a Refresh Token).
- Revoke Auth0 sessions to force users to log in and fetch a new Access Token (and a Refresh Token).
NOTE: When a user exchanges a Refresh Token obtained before the role deletion for a new Access Token, the new Access Token accurately reflects the updated permissions.
