Skip to main content
Supplemental Signals is available for Enterprise customers, and you must request the Attack Protection Add-on. Contact Auth0 Sales for more information.

Before you start

To use Akamai Supplmental Signals in Actions, you must:
Once you have configured Akamai to use Supplemental Signals, you can use the data provided in those signals in Auth0 Actions.

​
Supported Supplmental Signals by Action trigger

TriggerSupplemental Signal objectsEvent object
Login• akamaiBot
• akamaiUserRisk		event.authentication.riskAssessment.supplemental.akamai
Pre-User Registration• akamaiBot
• akamaiUserRisk		event.authentication.riskAssessment.supplemental.akamai
Post-User Registration• akamaiBot
• akamaiUserRisk		event.authentication.riskAssessment.supplemental.akamai
Send Phone MessageNoneN/A
Post-Challenge• akamaiBot
• akamaiUserRisk		event.authentication.riskAssessment.supplemental.akamai
Post-Change Password• akamaiBot
• akamaiUserRisk		event.authentication.riskAssessment.supplemental.akamai
Credentials ExchangeNoneN/A

​
Supplemental Signal object schemas

The akamaiBot and akamaiUserRisk objects contain multiple properties you can use to customize your authentication flow.
​
akamaiBot
object
​
akamaiUserRisk
object

​
Use cases

Here’s an example of how you could revoke a session based on the akamaiUserRisk.score property:
exports.onExecutePostLogin = async (event, api) => {
  const userRiskHeader = event.authentication?.riskAssessment?.supplemental?.akamai?.akamaiUserRisk;
  if (userRiskHeader?.score && userRiskHeader?.score >= 90) {
        console.log('User is deemed high risk.');
        //This will revoke session cookies to deny login.
        api.session.revoke('Session revoked, User risk score is greater than 90.');
    }
};
Using the api.session.revoke method (compared to the api.access.deny method) ensures that if the user refreshes the application, the Akamai Supplmental Signals are sent with the authentication request and the post-login Action flow is triggered.
Here’s an example of how you could enforce MFA based on the akamaiBot.score property.

​
Enforce MFA

This Action performs two tasks:
  1. Update app metadata: If the score property exceeds a specified value, record that MFA is required for the session.
  2. Require MFA: If the score property exceeds a specified value or if there is a record in the app metadata indicating MFA is required for the session, enforce MFA.
exports.onExecutePostLogin = async (event, api) => {
  const userRiskHeader = event.authentication?.riskAssessment?.supplemental?.akamai?.akamaiUserRisk;

  if (userRiskHeader?.score && userRiskHeader?.score >= 90) {
    console.log(`Setting app metadata for session id: ${event.session?.id}`);
    api.user.setAppMetadata(`mfa_required_${event.session?.id}`, true);
  }

  if (userRiskHeader?.score && userRiskHeader?.score >= 90 ||
      event.user.app_metadata[`mfa_required_${event.session?.id}`]) {
        console.log(`Requiring MFA FOR Session id: ${event.session?.id}`);
        api.multifactor.enable('any', {allowRememberBrowser: false});
  }
};

​
Clean up app metadata

This Action removes session-specific MFA information from app metadata after the user completes MFA successfully.
exports.onExecutePostLogin = async (event, api) => {
  const mfaMethod = event.authentication?.methods.find((method) => {
    return method.name === 'mfa';
  });

  if (mfaMethod) {
    console.log(`Removing MFA requirement for session id: ${event.session?.id}`);
    api.user.setAppMetadata(`mfa_required_${event.session?.id}`, undefined);
  }
};