Secure hub for user data on move

User metadata is the lifeblood of Identity and Access Management (IAM) services. It fuels product features like data analysis, personalized experiences, security monitoring, and access control. But as applications become more interconnected across platforms, organizations, and applications, managing user metadata can get complex. Fear not! By understanding the flow of user data, you can build a seamless and secure authentication experience.

Auth data vs. user data#

Not all user data is created equal. Auth data is a specific subset exchanged during token issuance. Imagine a JWT (JSON Web Token) traveling in your HTTP requests. A large JWT can slow things down. To keep things speedy and secure, we only include essential user information like identity, account status, authentication details, permissions, and a basic user profile.

Here at Logto, we focus on storing the following auth data points:

• Account status: Track creation time, updates, suspension status, and login history. Including create_at , updated_at, account_suspended, last_ip.
• Authentication info: This includes user identifiers, authentication factors, and verification-related data. Including user_id, password_digest, password_algorithm, username, email, email_verified, phone, phone_verified, social_identities, sso_identities, mfa_config, mfa_verification_factors.
• Authorization info: Manage roles, permissions, organization memberships, and authorized applications and devices for granular access control. Including role, permission, organization_id, organization_role, organization_permission, grant_application, grant_device.
• Standard user profile: This is the most common user profile registered by OIDC. Logto also sets it as the default user metadata, stored under the namespace 'profile.'. Including first_name, last_name, middle_name, name, nickname, profile, website, avatar, gender, birthdate, zoneinfo, locale, address.

Beyond the basics: Customizing user data with Logto

• Logto goes beyond the standard profile. Our Management API lets you define custom data specific to your business needs. This data is stored securely under a dedicated namespace ‘custom.data’. Here are some cases: occupation, company_name, company_size.

Thinking outside the vault: external API data with custom JWT

• Certain business data might not need permanent storage in Logto. The beauty of Custom JWT is that you can dynamically fetch this data via API calls during token issuance, expanding the reach of your user data. Remember, security is paramount, so avoid including sensitive information in JWTs as they are readily parsed. Here are some cases: subscribed_status, last_path_visited, app_theme.

The user data journey: acquisition & distribution#

User data comes from various sources:

• User input: During signup, onboarding, or profile updates within your application.
• Identity providers (IdPs): Seamlessly synced during Social logins or Enterprise SSO.
• Data migrations: Moving data from existing databases.
• Admin intervention: Admin edits manually via the console or database.

Once you have this valuable data, you can share it securely:

• Granting permissions to third-party apps: Provide controlled access to user data for authorized applications.
• Data exports: Export user data from Logto for further analysis.
• Delivery via JWTs, Webhooks, or APIs: Share user data with your internal services for a unified user experience.

As an identity center, Logto excels at facilitating the flow of user data. We make it easy to acquire user information from various providers and securely deliver it to authorized parties.

Key points#

Now that you understand the user data journey, let's explore some key design considerations:

1. Attribute mapping Ensure accurate mapping of user attributes from different sources to avoid data silos. For SAML connections, manual mapping is required. When using OIDC, leverage standardized claims or create unique namespaces to prevent conflicts.
2. IdP and RP data sync Data synchronization between the IdPs (identity providers) and RPs (relying parties) typically involves authorization and specific scope requests on both sides. Be mindful of verification status. A synchronized "Email verified=false" from an IdP like GitHub or Azure AD might not be a verified email in your system. Handle it accordingly.
3. Data segregation and overwriting in a multi-entity structure In complex environments with multiple organizations, applications, and providers, data segregation and overwrite behavior become crucial.
   • Multi-organization: A user can belong to multiple organizations. Differentiate user data stored under the user account from organization-specific data. Changes within one organization shouldn't affect others.
   • Multi-app: For applications sharing a user database via Logto, implement a centralized account settings or profile settings module in your service.
   • Multi-provider: Applications with various sign-in methods receive different user information from each provider. In Logto, choose to sync data during social login registration or at every login for Enterprise SSO. Social login is ideal for upfront data sync, while Enterprise SSO can sync member information at each login for easier management within the enterprise IdP.
4. Custom JWTs for expanded data access The power of Custom JWTs lies in their ability to retrieve external information dynamically during token issuance via API calls. This lets you access data points that might not be essential for core functionality but can enrich the user experience. Remember, with great flexibility comes great responsibility. Since JWTs are readily parsed by anyone who receives them, avoid including sensitive data.
5. Progressive registration for a smoother onboarding flow Don't overwhelm users with a registration form the length of a novel. Implement progressive registration, a technique where you request only the most critical user information initially. This streamlines the signup process and keeps users engaged. As users interact with your application, you can gradually collect additional data points to build a richer user profile.

By following these best practices, you can ensure a smooth and secure flow of user data throughout the authentication journey.

Logto: Your secure hub for user data on move#

Effectively managing user metadata empowers you to personalize user experiences, enhance security, and gain valuable insights into user behavior. By leveraging Logto's secure and flexible platform, you can unlock the full potential of user data and gain a competitive edge in today's data-driven landscape.