Skip to main content
All projects
Security
/projects/auth0-migration

Auth0 Tenant Migration

project.auth0-migration.local
Auth0 Tenant Migration project screenshot

  1. Problem:

    Legacy Auth0 tenant had security and scalability issues.

  2. Solution:

    Executed zero-downtime migration for 1,000+ users with least-privilege IAM via AWS SSO.

  3. Impact:

    Zero user disruption, improved security posture, unified identity system.

Overview

Identity migration with rollback strategy and IAM alignment so security improvements don't become a customer-facing outage.

Results & metrics

  • Zero-downtime migration of 1,000+ active users without forced password resets
  • Discovered and removed hidden AWS Cognito proxy layer, saving $15,000/year
  • Consolidated dual-tenant infrastructure into single modern Auth0 tenant
  • Implemented AWS SSO with least-privilege IAM policies across internal teams

Before / after

  • Customer Experience

    Before: High churn risk from forcing 1,000+ users through password resets upon rebrand

    After: Completely invisible cutover using executive-approved password hash export

  • Annual Cloud Costs

    Before: Paying $15k/year for redundant AWS Cognito layer proxying Auth0 requests

    After: Zero intermediate proxy costs by routing directly to unified Auth0 tenant

  • Identity Architecture

    Before: Fragmented accounts split between legacy Lynks and new Rivafy systems

    After: Single unified tenant with enterprise-grade AWS SSO integration

What I built

Zero-downtime cutover

1,000+ users moved from Lynks to Rivafy with their password hashes: no reset prompts.

Hidden layer removed

Cognito users moved directly into Auth0, removing a hidden layer that cost $15k/year.

Stack

  • Auth0 Management API
  • AWS Cognito Identity Pools
  • AWS SSO & IAM Least Privilege
  • Node.js Migration CLI Scripts
  • JSON Schema Validation

Decisions

Key trade-offs and design calls that shaped the final delivery.

  • Password hash export over force-reset

    Why
    Context
    Forcing password resets would damage brand reputation and create support burden—users would see 'incorrect password' errors
    Decision
    Worked with Auth0 executives to obtain password hashes for seamless migration—no user disruption, no password reset prompts

  • Board-level escalation

    Why
    Context
    Password hash export requires executive approval due to sensitive credential data handling
    Decision
    Engaged board members to secure necessary permissions—owned end-to-end from discovery through execution

  • Post-migration architecture review

    Why
    Context
    After Auth0 migration, noticed unexplained AWS Cognito API calls in billing
    Decision
    Deep dive revealed Auth0 was proxying to Cognito for legacy users—migrated them directly to Auth0, cut $15k/year

Architecture

The primary system boundaries, runtime pieces, and how the project was structured in production.

Diagram, 6 connections:
  1. Lynks Auth0 Tenant → Password Hash Export
  2. Hidden AWS Cognito Proxy → Password Hash Export
  3. Password Hash Export → User Identity Normalization
  4. User Identity Normalization → Target Auth0 Rivafy Tenant
  5. Target Auth0 Rivafy Tenant → AWS SSO Least-Privilege
  6. Web & Mobile Applications → Target Auth0 Rivafy Tenant (Zero-Downtime Cutover)
Groups: Legacy Split Tenants: Lynks Auth0 Tenant, Hidden AWS Cognito Proxy; Secure Transition: Password Hash Export, User Identity Normalization; Unified Production IAM: Target Auth0 Rivafy Tenant, AWS SSO Least-Privilege; Customer Touchpoints: Web & Mobile Applications.
  • Legacy Auth0 (Lynks) + AWS Cognito

    Source Systems

    How

    Legacy customers on Lynks Auth0 tenant, new customers on Rivafy Auth0. Hidden AWS Cognito layer discovered during migration was proxying requests and adding cost.

  • Auth0 Executive Engagement

    Migration Coordination

    How

    Direct calls with Auth0 executives to obtain password hash export,required board-level approval due to sensitive credential data.

  • New Auth0 Tenant (Rivafy)

    Target System

    How

    Seamless user migration without password reset prompts—users never experienced disruption or incorrect password messages.

  • Post-Migration AWS Review

    Cost Optimization

    How

    Discovered Auth0 was fetching from Cognito for legacy users—migrated Cognito users directly to Auth0, eliminating $15k/year intermediate layer.

Mermaid source

Paste into mermaid.live to edit the diagram.

flowchart LR
  subgraph Source [Legacy Split Tenants]
    LNK[Lynks Auth0 Tenant]
    COG[Hidden AWS Cognito Proxy]
  end
  subgraph Migration [Secure Transition]
    EXP[Password Hash Export]
    VAL[User Identity Normalization]
  end
  subgraph Target [Unified Production IAM]
    RIV[Target Auth0 Rivafy Tenant]
    SSO[AWS SSO Least-Privilege]
  end
  subgraph Apps [Customer Touchpoints]
    APP[Web & Mobile Applications]
  end
  LNK --> EXP
  COG --> EXP
  EXP --> VAL
  VAL --> RIV
  RIV --> SSO
  APP -->|Zero-Downtime Cutover| RIV

Pipeline

How changes moved from development through validation and deployment.

Select a step for its detail

Incidents

Operational failures, rehearsals, or recovery moments that changed how the system was run.

  • P1

    Split tenant discovery during rebranding

    Resolution

    End-to-end ownership including Auth0 executive calls and board escalation—password hash export approved and executed

    Lesson: User-facing auth changes require executive-level coordination to avoid brand damage—don't force password resets on rebrand

  • P2

    Hidden Cognito proxy costs

    Resolution

    Migrated legacy Cognito users directly to Auth0, eliminated intermediate layer

    Lesson: $15k/year savings from post-migration architecture review—always audit costs after major infrastructure changes