Configure Auth0 for agent IAM

Configure users and OIDC applications in Auth0 to use with Vault Enterprise agentic IAM.

Before you start

• You must have an Auth0 tenant with an Auth0 Enterprise plan (or better) to enable and remove Rich Authorization Request (RAR) and Pushed Authorization Requests (PAR).

• You must have sufficient permission for your Auth0 tenant. You must have permissoion to create resources (applications, APIs, users) and configure RAR/PAR features.

• You must have the oauth2c CLI installed and in your system PATH to interact with OAuth 2.0 authorization servers.

Step 1: Enable pushed authorization requests

Enable Pushed Authorization Requests (PAR) tenant-wide. You need PAR support (RFC 9126) to attach RAR claims. Standard authorization requests cannot carry complex JSON structures.

1. Log in to your Auth0 dashboard.

2. Navigate to Settings > Advanced.

3. Toggle the Allow Pushed Authorization Requests (PAR) setting to ON.

Step 2: Create a custom API

1. Navigate to Applications > APIs.

2. Click Create API.

3. In the Name field, enter a name value (for example, vault-api).

4. In the Identifier field, provide the API address of you Vault cluster. The identifier value eventually becomes the JWT aud claim.

5. For JSON Web Token (JWT) Profile, select RFC 9068.

6. Scroll down and click Create.

7. Click the Settings.

8. Scroll down to RBAC Settings.

9. Click the toggle to switch on Enable RBAC.

10. Click the toggle to switch on Add Permissions in the Access Token.

11. Click Save.

Step 3: Create an Auth0 application

1. Navigate to Applications > Applications, then click Create Application.

2. Enter a custom name for the Name field.

3. Select an appropriate application type.

4. Click Create.

5. Open the Settings page and note the Client ID, Domain, and Client Secret for your application.

6. Scroll to Application URIs section.

7. Add the default callback for oauth2 to the Allowed Callback URLs list, http://localhost:9876/callback so you can test the token exchange later.

8. Scroll to the Authorization Requests section.

9. Toggle Require Pushed Authorization Requests (PAR) to ON to make PAR mandatory for your application.

10. Click Advanced Settings.

11. Click OAuth.

12. In the Allowed APPs/APIs field, enter your Vault API address (for example, https://<vault-addr>:8200/v1).

13. Open the Grant Types tab and check Authorization Code.

14. Open the Endpoints tab and record both the OAuth Authorization URL and the JSON Web Key Set URL values for use later.

15. Click Save.

Step 4: Register the RAR authorization details type

Rich Authorization Requests (RAR) require Auth0 to recognize the custom authorization details type that Vault expects (vault:path_access). With PAR enabled, register an authorization details type named vault:path_access for your tenant.

1. Navigate to Auth0 Dashboard > Applications > APIs.

2. Select the API you created.

3. Click Permissions.

4. Under Add an Authorization Details type in the Type field, enter vault:path_access.

5. Click + Add to automatically save the authorization details type settings.

Step 5: Grant application access

With the API and application both created, you need to grant client access from the API to the application.

1. Navigate to Auth0 Dashboard > Applications > APIs.

2. Select the API you created.

3. Click Application Access.

4. Find your application, and click Edit.

5. Click Grant Access.

6. Click the Always grant all permissions checkbox.

7. Click Save.

Step 6: Allow the application to request the RAR type

The Always grant all permissions checkbox does not configure whether applications can request the vault:path_access authorization details (RAR) type.

Auth0 controls whether an application may request a registered authorization_details type through the User-Delegated Access policy associated with the API.

Step 7: Create an agent user

1. Navigate to User Management > Users.

2. Click Create User.

3. Select Create via UI or Create via JSON.

4. Enter the appropriate information for Email and Password.

5. Click Create.

6. On the user page, click Edit next to Email, and mark the email as verified.

Step 8: Capture a baseline token

Export the Auth0 values you recorded, then run oauth2c to confirm the trust and to capture the iss and sub claims you need for the Vault profile and entity aliases.

1. Save the Auth0 configuration values as environment variables. Replace the placeholders with your actual values from the Auth0 application settings:

   $ export \
       APP_AUTH_URL="https://<your_tenant>.us.auth0.com/authorize" \
       APP_DOMAIN="<application_domain>"                           \
       APP_ID="<application_client_id>"                            \
       SECRET_VALUE="<application_client_secret>"                  \
       JWKS_URI="https://<your_tenant>.us.auth0.com/.well-known/jwks.json"
   

2. Save the Vault server address as AUDIENCE_ADDR so you can easily request the correct audience in the access token:

   $ export AUDIENCE_ADDR=${VAULT_ADDR}/v1
   

3. Request an access token using the OAuth 2.0 authorization code flow with PKCE and PAR:

   $ oauth2c "${APP_AUTH_URL}"           \
       --pkce                            \
       --par                             \
       --client-id "${APP_ID}"           \
       --client-secret "${SECRET_VALUE}" \
       --response-types code             \
       --response-mode query             \
       --grant-type authorization_code   \
       --audience ${AUDIENCE_ADDR}       \
       --auth-method client_secret_basic
   

   Note

   You must request the audience (--audience https://<vault_addr>:8200/v1) to receive a signed JWT. Without it, Auth0 returns an opaque token that Vault cannot validate.

4. When oauth2c opens a browser, sign in with the email address and password you set for the agent user. After a successful sign-in, the terminal prints a success message along with a JSON object with the decoded access token. For example:

   {
     "aud": "https://localhost:8200/v1",
     "client_id": "EBYeLHzuLqSeyUYLY7EC3hqRgvaiS9Dv",
     "exp": 1782402664,
     "iat": 1782316264,
     "iss": "https://hashicups-dev.us.auth0.com/",
     "jti": "baFC3mowpruhSr1JdDRhbJ",
     "permissions": [],
     "sub": "auth0|c0ff33a2dc1f8e9de0dd95d7"
   }
   

5. Save the iss and sub values to environment variables. The sub value contains a pipe character, so make sure wrap to wrap the string in quotes:

   $ export                                         \
       ISSUER="https://hashicups-dev.us.auth0.com/" \
       EXTERNAL_ID='auth0|c0ff33a2dc1f8e9de0dd95d7'
   

Step 9: Save your provider information

Confirm your subject and actor details from Auth0. To configure agentic IAM, you must have the following information:

If you have not already, we recommend setting the following environment variables to make Vault configuration more convenient:

$ export                                \
   VAULT_ADDR="<your_vault_server_url>" \
   APP_AUTH_URL="<app_auth_url>"        \
   APP_DOMAIN="<app_domain>"            \
   APP_ID="<app_client_id>"             \
   ISSUER="<app_iss_url>"               \
   EXTERNAL_ID="<app_jwt_sub>"          \
   JWKS_URI="<app_jwks_url>"            \
   SECRET_VALUE="<app_client_secret>"   \
   AUDIENCE_ADDR="<aud_address>"

For example:

$ export                                                              \
   VAULT_ADDR="https://127.0.0.1:8200"                                \
   APP_AUTH_URL="https://abc-123if67e.us.auth0.com/authorize"         \
   APP_DOMAIN="abc-123if67e.auth0.com"                                \
   APP_ID="ABCD...abc"                                                \
   ISSUER="https://hashicups-dev.us.auth0.com/"                       \
   EXTERNAL_ID="auth0|c0ff33a2dc1f8e9de0dd95d7"                       \
   JWKS_URI="https://abc-123if67e.us.auth0.com/.well-known/jwks.json" \
   SECRET_VALUE="000000...000000"                                     \
   AUDIENCE_ADDR="https://127.0.0.1:8200/v1"

Next steps

• Configure Vault to secure agentic workflows
• Configure Vault to secure OBO workflows
• Configure additional identity providers and authentication servers:
  • Configure IBM Verify for agent IAM
  • Configure Microsoft Entra ID for agent IAM
  • Configure Okta for agent IAM