# Liferay Auth 

**URL:** <https://discuss.liferay.com/t/liferay-auth/96>\
**Category:** General\
**Created:** [October 2, 2025, 11:36pm UTC](https://discuss.liferay.com/t/liferay-auth/96 "2025-10-02T23:36:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![flashyjen](https://dub1.discourse-cdn.com/flex014/user_avatar/discuss.liferay.com/flashyjen/32/275_2.png) [@flashyjen](https://discuss.liferay.com/u/flashyjen)\
**Post date:** [October 2, 2025, 11:36pm UTC](https://discuss.liferay.com/t/liferay-auth/96/1 "2025-10-02T23:36:05Z")

</div>

Reading about Liferay integration with Auth0 here.

[https://learn.liferay.com/w/dxp/security-and-administration/security/configuring-sso/configuring-liferay-authentication-with-auth0-using-openid-connect](https://learn.liferay.com/w/dxp/security-and-administration/security/configuring-sso/configuring-liferay-authentication-with-auth0-using-openid-connect)

Based on the documentation, after successful authentication on Auth0, request gets redirected to Liferay callback URI with an auth token. My question is, how does Liferay determine that ‘auth token‘ is for a successfully authenticated user? can someone generate an ‘auth token’ on the fly to spoof a user?

The reason I’m asking that question is because I wanted to find out, if my Liferay App need additional call to Auth0 with this ‘auth token’ to ensure it is valid?

---

<div class="post-metadata">

**Author:** ![olafk](https://dub1.discourse-cdn.com/flex014/user_avatar/discuss.liferay.com/olafk/32/21_2.png) [@olafk](https://discuss.liferay.com/u/olafk)\
**Post date:** [October 3, 2025, 8:21am UTC](https://discuss.liferay.com/t/liferay-auth/96/2 "2025-10-03T08:21:05Z")

</div>

Should be well documented in OpenID Connect.

My assumption is that an additional payload (e.g. parameters, json, xml etc) will be part of the redirection, and very likely cryptographically signed.

---

<div class="post-metadata">

**Author:** ![Zsigmond\_Rab](https://dub1.discourse-cdn.com/flex014/user_avatar/discuss.liferay.com/zsigmond_rab/32/147_2.png) [@Zsigmond\_Rab](https://discuss.liferay.com/u/Zsigmond_Rab)\
**Post date:** [October 3, 2025, 8:53am UTC](https://discuss.liferay.com/t/liferay-auth/96/3 "2025-10-03T08:53:24Z")

</div>

Everything happens according to the parts for Relying Parties detailed in the [Final: OpenID Connect Core 1.0 incorporating errata set 2](https://openid.net/specs/openid-connect-core-1_0.html) specification.