Migration from Auth0

Migrate from Auth0 roles and permissions to PlatformXe authorization.

This guide covers migrating your authorization logic from Auth0 to PlatformXe. The process maps Auth0 concepts to their PlatformXe equivalents and uses shadow checking to validate before cutover.

Concept mapping

Auth0	PlatformXe	Notes
Roles	Roles (Simple or Full model)	Direct mapping
Permissions	Capabilities (path:action)	Rename to match format
Organizations	Tenants	1:1 mapping
Rules/Actions	Resource policies (ABAC)	Condition-based evaluation
Authorization Extension	Federation	For multi-app setups

Step 1: Export Auth0 roles and permissions

Use the Auth0 Management API to export your current configuration:

// Fetch all roles from Auth0
const auth0Roles = await auth0.roles.getAll();

// For each role, get its permissions
for (const role of auth0Roles) {
  const permissions = await auth0.roles.getPermissions({ id: role.id });
  console.log(`${role.name}:`, permissions.map(p => p.permission_name));
}

Step 2: Create matching roles in PlatformXe

Map Auth0 permissions to PlatformXe capabilities in path:action format:

// Auth0: "read:articles" → PlatformXe: "articles:read"
function mapPermission(auth0Permission: string): string {
  const [action, resource] = auth0Permission.split(':');
  return `${resource}:${action}`;
}

// Create roles in PlatformXe
for (const role of auth0Roles) {
  const capabilities = role.permissions.map(p => mapPermission(p.permission_name));

  await px.permissions.createRole({
    name: role.name,
    description: role.description,
    model: 'SIMPLE',
  });

  await px.permissions.setCapabilities(newRole.data.id, { capabilities });
}

Step 3: Run shadow checks

Add shadow checking to your middleware to compare Auth0 and PlatformXe decisions:

async function checkPermission(userId: string, path: string, action: string) {
  // Get Auth0 decision
  const auth0Result = await checkAuth0Permission(userId, path, action);

  // Compare with PlatformXe
  const shadow = await px.permissions.shadowCheck({
    adminId: userId,
    path,
    action,
    localDecision: auth0Result,
  });

  if (shadow.data.discrepancy) {
    logger.warn('Auth migration mismatch', { userId, path, action });
  }

  // Use Auth0 decision during shadow phase
  return auth0Result;
}

Step 4: Fix discrepancies

Common causes of discrepancies:

Issue	Fix
Permission naming mismatch	Verify path:action mapping
Missing role assignments	Ensure all users are assigned roles in PlatformXe
Auth0 Rules logic	Convert to ABAC resource policies
Organization-scoped permissions	Use PlatformXe tenant isolation

Step 5: Cut over

Once shadow checks show zero discrepancies for at least one week:

1. Switch reads to PlatformXe
2. Keep Auth0 active as fallback for two weeks
3. Remove Auth0 permission checks
4. Decommission Auth0 authorization features