Skip to main content

Configure Auth0

This guide connects DIAL to Auth0 so users authenticate with Auth0 and DIAL authorizes them by Auth0 role. Because Auth0 does not place roles in the access token by default, you add a post-login action that injects a dial_roles claim. For the shared workflow, see the SSO / IdP setup overview.

Prerequisites​

  • A running DIAL deployment and the URL of your DIAL Chat instance, referred to below as <chat_url>.
  • An Auth0 tenant with permission to create applications and actions.

Step 1: Configure Auth0​

  1. Create a tenant if you do not have one.

  2. Create an application of type Regular Web Applications. Set Allowed Callback URLs to <chat_url>/api/auth/callback/auth0.

  3. From the application Settings, capture the Domain (<auth0_domain>), Client ID, and Client secret.

  4. Create an API under Applications → APIs and note its identifier (<auth0_api_audience>).

  5. Create users under User Management → Users.

  6. (Optional, RBAC) Create roles under User Management → Roles and assign them to users.

  7. (Optional, RBAC) Add a post-login action under Actions → Library (trigger Login / Post Login, runtime Node 22) to inject the roles claim, then deploy it and add it to the post-login trigger flow:

    exports.onExecutePostLogin = async (event, api) => {
      if (event.authorization) {
        api.accessToken.setCustomClaim("dial_roles", event.authorization.roles);
        api.accessToken.setCustomClaim("email", event.user.email);
      }
    };

Step 2: Configure DIAL Chat​

Set these environment variables on DIAL Chat. See DIAL Chat configuration — Auth0 for the full list.

AUTH_AUTH0_HOST: "https://<auth0_domain>"
AUTH_AUTH0_CLIENT_ID: "<auth0_client_id>"
AUTH_AUTH0_SECRET: "<auth0_client_secret>"
AUTH_AUTH0_AUDIENCE: "<auth0_api_audience>"

Step 3: Configure DIAL Core​

Add the provider to the identityProviders section of DIAL Core static settings (settings.json). <auth0_domain_regex> is <auth0_domain> with dots escaped (for example, example\.eu\.auth0\.com). Generate a random loggingSalt, for example with pwgen -s 32 1.

{
  "identityProviders": {
    "auth0": {
      "jwksUrl": "https://<auth0_domain>/.well-known/jwks.json",
      "issuerPattern": "^https:\\/\\/<auth0_domain_regex>.*$",
      "loggingKey": "sub",
      "loggingSalt": "<random_salt>",
      "rolePath": "dial_roles"
    }
  }
}

rolePath is dial_roles — the claim added by the post-login action. For every setting, see the Identity providers reference.

note

DIAL Core reads static settings at startup. Restart Core after editing settings.json. Each setting can also be supplied as an aidial.identityProviders.auth0.* environment variable.

Step 4: Assign roles to resources​

In config.json (dynamic settings), add an Auth0 role name to a deployment's userRoles array.

{
  "models": {
    "chat-gpt-35-turbo": {
      "userRoles": ["auth0-role-name"]
    }
  }
}

Result​

Users log in through Auth0, the post-login action adds their roles to the token, and DIAL Core authorizes requests based on those role values.

Further reading​