Casos de uso

Obtenga información sobre los casos de uso de la función Tenant Access Control List.

​

Bloquear una solicitud

Este ejemplo de regla ACL de Tenant bloquea el tráfico entrante de un código de país de geolocalización específico.

Management API

Para crear esta regla ACL de Tenant con la Management API:

1. Obtén un token de acceso de la Management API con el scope create:network_acls.

2. Llama al endpoint Create access control list de la Management API con el siguiente cuerpo:

{
  "description": "Example of blocking a request",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "scope": "authentication"
  }
}{
  "description": "Example of blocking a request",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "scope": "authentication"
  }
}

Go SDK

package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of blocking a request"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(2),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Block: auth0.Bool(true),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}

Node SDK

const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Example of blocking a request",
  active: true,
  priority: 2,
  rule: {
    action: {
      block: true,
    },
    match: {
      geo_country_codes: ["{geoCountryCode}"],
    },
    scope: "authentication",
  },
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);

Terraform

resource "auth0_network_acl" "example_blocking_request_acl" {
    description = "Example of blocking a request"
    active = true
    priority = 2
    rule {
        action {
            block = true
        }
        match {
            geo_country_codes = ["{geoCountryCode}"]
        }
        scope = "authentication"
    }
}

Deploy CLI

networkACLs:
  - description: Example of blocking a request
    active: true
    priority: 2
    rule:
      action:
        block: true
      match:
        geo_country_codes:
          - {geoCountryCode}
      scope: authentication

Auth0 CLI

auth0 network-acl create \
    --description "Example of blocking a request" \
    --active true \
    --priority 2 \
    --rule '{"action":{"block":true},"match":{"geo_country_codes":["{geoCountryCode}"]},"scope":"authentication"}'

Este es un ejemplo de una página de bloqueo:

​

Permitir una solicitud

Este ejemplo de regla de ACL de Tenant permite el tráfico solo desde un código de país de geolocalización específico.

Management API

Para crear esta regla de ACL de Tenant con la Management API:

1. Obtén un token de acceso de Management API con el scope create:network_acls.

2. Llama al endpoint Create access control list de la Management API con el siguiente cuerpo:

{
  "description": "Example of allowing a request",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "allow": true
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "scope": "authentication"
  }
}

Go SDK

package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of allowing a request"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(2),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Allow: auth0.Bool(true),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}

Node SDK

const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Example of allowing a request",
  active: true,
  priority: 2,
  rule: {
    action: {
      allow: true,
    },
    match: {
      geo_country_codes: ["{geoCountryCode}"],
    },
    scope: "authentication",
  },
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);

Terraform

resource "auth0_network_acl" "example_allowing_request_acl" {
    description = "Example of allowing a request"
    active = true
    priority = 2
    rule {
        action {
            allow = true
        }
        match {
            geo_country_codes = ["{geoCountryCode}"]
        }
        scope = "authentication"
    }
}

Deploy CLI

networkACLs:
  - description: Example of allowing a request
    active: true
    priority: 2
    rule:
      action:
        allow: true
      match:
        geo_country_codes:
          - {geoCountryCode}
      scope: authentication

Auth0 CLI

auth0 network-acl create \
    --description "Example of allowing a request" \
    --active true \
    --priority 2 \
    --rule '{"action":{"allow":true},"match":{"geo_country_codes":["{geoCountryCode}"]},"scope":"authentication"}'

​

Redirigir una solicitud

Este ejemplo de regla ACL de tenant redirige todo el tráfico procedente de un código de país de geolocalización específico.

Management API

Para crear esta regla ACL de tenant con la Management API:

1. Obtén un token de acceso para la Management API con el scope create:network_acls.

2. Llama al endpoint Create access control list de la Management API con el siguiente cuerpo:

{
  "description": "Example of redirecting a request",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "redirect": true,
      "redirect_uri": "REDIRECT_URI"
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "scope": "authentication"
  }
}

Go SDK

package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of redirecting a request"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(2),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Redirect: auth0.Bool(true),
				RedirectURI: auth0.String("REDIRECT_URI"),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}

Node SDK

const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Example of a complex comparison",
  active: true,
  priority: 1,
  rule: {
    action: {
      block: true,
    },
    match: {
      geo_country_codes: ["{geoCountryCode}"],
    },
    not_match: {
      geo_subdivision_codes: ["{geoSubdivisionCode}"],
    },
    scope: "authentication",
  },
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);

Terraform

resource "auth0_network_acl" "example_complex_comparison_acl" {
    description = "Example of a complex comparison"
    active = true
    priority = 1
    rule {
        action {
            block = true
        }
        match {
            geo_country_codes = ["{geoCountryCode}"]
        }
        not_match {
            geo_subdivision_codes = ["{geoSubdivisionCode}"]
        }
        scope = "authentication"
    }
}

Deploy CLI

networkACLs:
  - description: Example of a complex comparison
    active: true
    priority: 1
    rule:
      action:
        block: true
      match:
        geo_country_codes:
          - {geoCountryCode}
      not_match:
        geo_subdivision_codes:
          - {geoSubdivisionCode}
      scope: authentication

Auth0 CLI

auth0 network-acl create \
    --description "Example of a complex comparison"
    --active true \
    --priority 1 \
    --rule '{"action":{"block":true},"match":{"geo_country_codes":["{geoCountryCode}"]},"not_match":{"geo_subdivision_codes":["{geoSubdivisionCode}"]},"scope":"authentication"}'

​

Comparaciones complejas

Puede combinar los operadores match y not_match en una única regla de ACL de Tenant para aplicar políticas de acceso detalladas.

Este ejemplo de regla de ACL de Tenant evalúa las señales geo_country_code y geo_subdivision_code para bloquear todo el tráfico procedente de un país determinado, excepto el de un estado, región o provincia específicos dentro de ese país.

Management API

Para crear esta regla de ACL de Tenant con la Management API:

1. Obtenga un token de acceso de la Management API con el scope create:network_acls.

2. Llame al endpoint Create access control list de la Management API con el siguiente cuerpo:

{
  "description": "Example of a complex comparison",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "not_match": {
      "geo_subdivision_codes": [
        "{geoSubdivisionCode}"
      ]
    },
    "scope": "authentication"
  }
}

Go SDK

package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of a complex comparison"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(1),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Block: auth0.Bool(true),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			NotMatch: &management.NetworkACLRuleMatch{
				GeoSubdivisionCodes: &[]string{"{geoSubdivisionCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}

Node SDK

const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Example of a complex comparison",
  active: true,
  priority: 1,
  rule: {
    action: {
      block: true,
    },
    match: {
      geo_country_codes: ["{geoCountryCode}"],
    },
    not_match: {
      geo_subdivision_codes: ["{geoSubdivisionCode}"],
    },
    scope: "authentication",
  },
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);

Terraform

resource "auth0_network_acl" "example_complex_comparison_acl" {
    description = "Example of a complex comparison"
    active = true
    priority = 1
    rule {
        action {
            block = true
        }
        match {
            geo_country_codes = ["{geoCountryCode}"]
        }
        not_match {
            geo_subdivision_codes = ["{geoSubdivisionCode}"]
        }
        scope = "authentication"
    }
}

Deploy CLI

networkACLs:
  - description: Example of a complex comparison
    active: true
    priority: 1
    rule:
      action:
        block: true
      match:
        geo_country_codes:
          - {geoCountryCode}
      not_match:
        geo_subdivision_codes:
          - {geoSubdivisionCode}
      scope: authentication

Auth0 CLI

auth0 network-acl create \
    --description "Example of a complex comparison" \
    --active true \
    --priority 1 \
    --rule '{"action":{"block":true},"match":{"geo_country_codes":["{geoCountryCode}"]},"not_match":{"geo_subdivision_codes":["{geoSubdivisionCode}"]},"scope":"authentication"}'

​

Obligar a que el tráfico pase por una infraestructura específica

Puede combinar las señales hostnames y connecting_ipv4_cidrs para enrutar las solicitudes a su inquilino exclusivamente a través de su infraestructura autorizada, como un proxy inverso o una VPN.

Este ejemplo de regla de ACL de Tenant bloquea el acceso a su dominio canónico y a sus dominios personalizados, a menos que la solicitud se origine en un conjunto específico de direcciones IP que se conectan directamente al edge de Auth0. Esto evita que los usuarios eludan sus controles de seguridad accediendo directamente a los nombres de host de su inquilino desde la Internet pública.

Management API

Para crear esta regla de ACL de Tenant con la Management API:

1. Obtenga un token de acceso de la Management API con el create:network_acls scope.

2. Llame al endpoint Create access control list de la Management API con el siguiente cuerpo:

{
  "description": "Restrict access to specific proxy IPs for custom and canonical domains",
  "active": true,
  "priority": 10,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "any": [
        { "hostnames": ["auth.example.com"] },
        { "hostnames": ["my-tenant.us.auth0.com"] }
      ]
    },
    "not_match": {
      "connecting_ipv4_cidrs": [
        "192.0.2.0/24",
        "203.0.113.5/32"
      ]
    },
    "scope": "tenant"
  }
}