Qlik Cloud: How to set up Auth0 and map roles to groups (OIDC)

[Damien_V]

This article explains how to set up OIDC authentication with Auth0 and map Auth0 roles to groups in Qlik Cloud.

This customization is provided as is. Qlik Support cannot provide continued support of the solution. For assistance, reach out to our Professional Services or engage in our active Integrations forum.

Environment

Qlik Cloud

Auth0 Setup

1. Create a single page application
   
   Example:
   
   
   

   Note down Client ID and Client Secret

2. Add your Qlik Cloud tenant callback URL (original tenant URL) in the allowed Callback URLs, which should be https://<tenanturl>.<region>.qlikcloud.com/login/callback
   
   
3. Scroll to the Advanced Settings section
   
   
4. Open Endpoints and copy the OpenID configuration endpoint
   
5. On the menu on the left, go to Actions > Library 
   
   
6. Create a new custom action of type Login/Post Login and use the below code:
   
   

   exports.onExecutePostLogin = async (event, api) => { 
   const namespace = 'https://my-app.example.com';
   if (event.authorization) { 
   api.idToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles); 
   api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles); 
   api.user.setUserMetadata(`${namespace}/roles`, event.authorization.roles); 
   } 
   }

7. Click Deploy to activate the action.
   
   This action will pass the user roles in Auth0 to be used as groups in Qlik Cloud.

Qlik Cloud Setup

1. Set up a new OIDC Identity Provider and provider Auth0
2. In the OpenID configuration field, add the endpoint copied in the previous step 3 of your  Auth0 configuration
3. Fill in the Client ID and Client secret copied in the previous step 2 of your  Auth0 configuration
4. For the claims mapping, set the groups to "https://my-app.example.com/roles", adjust other settings based on your needs or leave as default
5. Make sure that Override email verified to true is checked and that scope is openid profile email
6. Save the settings and go through the validation procedure before activating the Identity Provider