Auth0 Authentication Setup

This guide explains how to configure Auth0 authentication for a self-hosted Qualytics deployment. Auth0 is an alternative authentication method managed by Qualytics. While OIDC is recommended for most self-hosted deployments, Auth0 is a simpler option for organizations that have internet access from their cluster and prefer a managed authentication service.

When to Use Auth0 vs OIDC

How Auth0 Works for Self-Hosted Deployments

Unlike OIDC (where you configure your own Identity Provider), Auth0 is a managed service where Qualytics handles the authentication infrastructure:

1. You request Auth0 resources from Qualytics
2. Qualytics provisions an Auth0 organization, client credentials, and SSO connections
3. You configure the provided values in your Helm deployment
4. Qualytics manages ongoing Auth0 maintenance and updates

Step 1: Request Auth0 Resources from Qualytics

Contact your Qualytics account manager to request Auth0 authentication for your self-hosted deployment. Include the following information in your request:

What You Will Receive

After Qualytics provisions your Auth0 resources, your account manager will provide:

Qualytics also provides a unique deployment identifier and an image registry token for the installation. These values are separate from the Auth0 credentials and from the platform license requested after installation.

Step 2: Configure Qualytics

Add the Auth0 values provided by Qualytics to your Helm values.yaml file:

Settings to Apply

Example values.yaml Configuration

global:
  dnsRecord: "qualytics.example.com"
  authType: "AUTH0"  # default; can be omitted

secrets:
  deployment:
    identifier: "<provided by Qualytics>"
  auth0:
    auth0_domain: "<provided Auth0 domain>"
    auth0_audience: "your-api-audience"
    auth0_organization: "org_your-org-id"
    auth0_spa_client_id: "your-spa-client-id"
  auth:
    jwt_signing_secret: "your-secure-random-string-min-32-chars"

Merge these authentication settings into the complete protected configuration supplied for your installation. Retain the other required values already present in that file.

Step 3: Deploy or Restart

If this is a new deployment, follow the Self-Hosted Deployment Guide to deploy Qualytics.

If you are updating an existing deployment:

CHART_VERSION="<version provided by Qualytics>"

helm upgrade qualytics qualytics/qualytics \
  --namespace qualytics \
  --version "$CHART_VERSION" \
  -f values.yaml \
  --wait \
  --timeout=20m

Use the complete protected values.yaml file that contains the installation's existing deployment identifier. Do not pass the identifier with --set, because command arguments can be stored in shell history and process logs.

Step 4: Verify Authentication

1. Navigate to your Qualytics instance in a browser (e.g., https://qualytics.example.com)
2. You should be redirected to the Auth0 login page
3. Authenticate using your credentials (or your enterprise SSO if configured)
4. After successful authentication, you should be redirected back to the Qualytics UI

Network Requirements

The Qualytics application and user browsers must have outbound HTTPS access to:

SSO Federation Through Auth0

Auth0 supports federating authentication with your enterprise Identity Provider. This means your users can log in to Qualytics using their existing corporate credentials through Auth0.

Supported federation protocols through Auth0:

• OpenID Connect (OIDC)
• SAML 2.0
• Active Directory / LDAP
• Azure Active Directory (Entra ID)
• Google Workspace
• Okta
• PingFederate

To set up SSO federation, include your IdP details when requesting Auth0 resources from Qualytics. Your account manager will configure the appropriate connection.

CLI Authentication

With Auth0, the Qualytics CLI supports browser-based authentication using the PKCE (Proof Key for Code Exchange) flow. Start it with:

qualytics auth login --url https://qualytics.example.com

Replace the example URL with your Qualytics deployment URL. A browser window opens automatically. Authenticate with Auth0 or your federated IdP, then approve access for the CLI. OIDC also supports browser-based CLI authentication through an active Qualytics browser session. Both modes provide a manual token fallback when the browser flow is unavailable.

Troubleshooting