Skip to main content
Auth0 Supplemental Signals is currently in Early Access.By using this feature, you agree to the applicable Free Trial terms in Okta’s Master Subscription Agreement. To learn more about Auth0 product release stages, read Product Release Stages.
Before you startTo use Akamai supplemental signals in Actions, you must:
If you have configured Akamai as a reverse proxy and set it up to send supplemental signals to Auth0, you can use the data provided in those signals in Auth0 Actions.

​
Supported supplemental signals by Action trigger

TriggerSupplemental signal objectsEvent object
Login
  • akamaiBot
  • akamaiUserRisk
authentication.riskAssessment.supplemental.akamai
Pre-User RegistrationNoneN/A
Post-User RegistrationNoneN/A
Send Phone MessageNoneN/A
Post-ChallengeNoneN/A
Post-Change PasswordNoneN/A
Credentials ExchangeNoneN/A

​
Supplemental signal object schemas

The akamaiBot and akamaiUserRisk objects contain multiple properties you can use to customize your authentication flow.
​
akamaiBot
object
​
akamaiUserRisk
object

​
Use cases

Here’s an example of how you could revoke a session based on the akamaiUserRisk.score property:
exports.onExecutePostLogin = async (event, api) => {
  const userRiskHeader = event.authentication?.riskAssessment?.supplemental?.akamai?.akamaiUserRisk;
  if (userRiskHeader?.score && userRiskHeader?.score >= 90) {
        console.log('User is deemed high risk.');
        //This will revoke session cookies to deny login.
        api.session.revoke('Session revoked, User risk score is greater than 90.');
    }
};
Please note the use of the api.session.revoke method (compared to the api.access.deny method). Using the revoke method ensures that if the user refreshes the application, the Akamai supplemental signals are sent with the authentication request and the post-login Action flow is triggered.
Here’s an example of how you could enforce MFA based on the akamaiBot.score property.

​
Enforce MFA

This Action performs two tasks:
  1. Update app metadata: If the score property exceeds a specified value, record that MFA is required for the session.
  2. Require MFA: If the score property exceeds a specified value or if there is a record in the app metadata indicating MFA is required for the session, enforce MFA.
exports.onExecutePostLogin = async (event, api) => {
  const userRiskHeader = event.authentication?.riskAssessment?.supplemental?.akamai?.akamaiUserRisk;

  if (userRiskHeader?.score && userRiskHeader?.score >= 90) {
    console.log(`Setting app metadata for session id: ${event.session?.id}`);
    api.user.setAppMetadata(`mfa_required_${event.session?.id}`, true);
  }

  if (userRiskHeader?.score && userRiskHeader?.score >= 90 ||
      event.user.app_metadata[`mfa_required_${event.session?.id}`]) {
        console.log(`Requiring MFA FOR Session id: ${event.session?.id}`);
        api.multifactor.enable('any', {allowRememberBrowser: false});
  }
};

​
Clean up app metadata

This Action removes session-specific MFA information from app metadata after the user completes MFA successfully.
exports.onExecutePostLogin = async (event, api) => {
  const mfaMethod = event.authentication?.methods.find((method) => {
    return method.name === 'mfa';
  });

  if (mfaMethod) {
    console.log(`Removing MFA requirement for session id: ${event.session?.id}`);
    api.user.setAppMetadata(`mfa_required_${event.session?.id}`, undefined);
  }
};
⌘I