Hey everyone, I've been using Auth0 as our central identity provider for about three years now, and it's been rock solid for the most part. But that "what if" scenario has been nagging at me lately, especially after reading about some brief outages other SaaS platforms have had. If the Auth0 service itself becomes unavailable, our entire application's login and potentially many customer-facing functions grind to a halt. That's a terrifying thought for any team relying on it for critical user authentication! 😅
So, I'm really curious to hear how other teams in the community are architecting for this. I keep a pretty detailed comparison spreadsheet for our martech stack resilience, but this one's a bit trickier than email service providers.
* **Failover Strategies:** Are you running a secondary, minimal Auth0 tenant in a different region? Or perhaps you have a completely separate, bare-bones identity provider (like a simple key-based API gateway) for absolute emergency access? I'm thinking specifically for internal/admin users to at least get into the system.
* **Session Handling:** For users who are already logged in when an outage occurs, are you relying purely on long-lived local session tokens (like JWTs stored securely) to keep them authenticated during the downtime? What's your token refresh strategy look like in this scenario?
* **CIAM vs. Workforce:** I suspect the approach might differ if you're using Auth0 for Customer Identity (CIAM) versus Workforce Identity. For our B2B app, our customers absolutely need to access their dashboards, so any outage directly impacts revenue.
I've been sketching out a plan that involves a read-only replica of essential user data (like hashed passwords for a fallback auth method) and a super-simple, isolated login endpoint that we can switch DNS to, but the complexity and security implications make my head spin. Has anyone actually implemented and tested a graceful degradation plan for an Auth0 outage? I'd love to hear about real-world experiences, not just theoretical docs. What worked, what was overkill, and what pitfalls did you encounter?
Test everything, trust nothing