Auth0 Multi-Tenant Architecture — Managing Multiple Organizations

# organizations_intro.py
# Auth0 Organizations overview

def organizations_feature():
    features = {
        "Organization Entity": "Represent each customer as an organization",
        "Organization Members": "Users associated with specific organizations",
        "Organization Connections": "Per-organization SSO and social connections",
        "Organization Roles": "Roles scoped to a specific organization",
        "Branding": "Per-organization branding for Universal Login",
        "Metadata": "Custom key-value data per organization",
        "Invitations": "Email invitations for organization members",
    }
    
    print("Auth0 Organizations Feature:")
    for feature, desc in features.items():
        print(f"  {feature:30s} | {desc}")

organizations_feature()

# create_organizations.py
# Creating and managing organizations

import requests
import os

def create_organization():
    domain = os.getenv("AUTH0_DOMAIN", "your-tenant.us.auth0.com")
    mgmt_token = os.getenv("AUTH0_MGMT_TOKEN", "your-mgmt-token")
    
    headers = {
        "Authorization": f"Bearer {mgmt_token}",
        "Content-Type": "application/json",
    }
    
    # Create an organization
    response = requests.post(
        f"https://{domain}/api/v2/organizations",
        headers=headers,
        json={
            "name": "acme-corp",
            "display_name": "Acme Corporation",
            "branding": {
                "logo_url": "https://acme.com/logo.png",
                "colors": {"primary": "#2563eb"}
            },
            "metadata": {
                "plan": "enterprise",
                "seats": 100
            }
        }
    )
    
    if response.status_code == 201:
        org = response.json()
        print(f"Organization created: {org['id']}")
        print(f"Name: {org['display_name']}")
        print(f"Status: {org.get('status', 'active')}")
        return org
    else:
        print(f"Failed: {response.text}")
        return None

create_organization()

# org_connections.py
# Per-organization connections

def org_connections_setup():
    print("Organization Connections:")
    print()
    print("Each organization can have its own:")
    print("  - SAML connection (corporate SSO)")
    print("  - Azure AD connection")
    print("  - Google Workspace connection")
    print("  - Social connections (optional)")
    print("  - Database connection (org-specific users)")
    print()
    print("How it works:")
    print("  1. Create connection in Auth0 (e.g., Acme SAML)")
    print("  2. Enable the connection for the organization")
    print("  3. Users from that org see only their SSO option")
    print("  4. Other orgs do not see this connection")
    print()
    print("API Endpoint:")
    print("  POST /api/v2/organizations/{org_id}/connections")
    print("  Body: { connection_id: 'con_xxx', assign_membership_on_login: true }")

org_connections_setup()

# org_roles.py
# Organization-scoped roles

def org_role_assignment():
    print("Organization Role Assignment:")
    print()
    print("Per-organization roles:")
    print("  Member: Can view and edit own data")
    print("  Admin: Can manage organization settings")
    print("  Billing: Can view billing information")
    print()
    print("Adding members with roles:")
    print("  POST /api/v2/organizations/{org_id}/members")
    print('  Body: {"members": ["auth0|user123"], "roles": ["rol_member", "rol_admin"]}')
    print()
    print("The token includes:")
    print("  - org_id: Which organization")
    print("  - org_roles: Roles within that org")
    print("  - permissions: Scoped to the organization")

org_role_assignment()

def multi_tenant_plan():
    print("Multi-Tenant Architecture Plan:")
    print()
    print("Organization setup:")
    print("  - Create org for each customer company")
    print("  - Configure per-org SAML or Google Workspace SSO")
    print("  - Assign org-specific branding")
    print()
    print("User management:")
    print("  - Invite users to specific orgs")
    print("  - Assign org-scoped roles (admin, member, viewer)")
    print("  - Users can belong to multiple orgs")
    print()
    print("Data isolation:")
    print("  - Extract org_id from token on each request")
    print("  - Filter database queries by org_id")
    print("  - Never expose data from other organizations")

multi_tenant_plan()