Auth0: one identity layer for a multi-property museum

The problem

Each property in the digital estate — the main site, ticketing, members area, education portals, internal tools [VERIFY] — historically solved login its own way. That means duplicated credential stores, inconsistent MFA, and no way to answer 'who is this person across our estate?' without a data project.

The architecture

Auth0 becomes the single authentication authority; every application is just an OIDC client. Authorisation is scoped with Auth0 Organizations so staff, members and partner roles live in one tenant without leaking across boundaries. Crucially, Auth0 authenticates but does not own the person: Tessitura remains the constituent system of record, linked by a stable identifier claim, so CRM history and identity never fork.

Decisions that mattered

• Organizations over tenants-per-property — one tenant, org-scoped roles; the alternative multiplies every policy change by the number of properties
• Migration with lazy password rehash so existing users were moved without a forced reset [VERIFY]
• MFA enforced by role sensitivity rather than blanket policy — staff and admin roles step up, casual members don't drown in friction
• Auth events streamed into the platform's observability stack, so anomalous login patterns surface with everything else [VERIFY]

Outcomes

One credential works across the estate, security posture is set in one place, and every new property is an afternoon of OIDC configuration instead of a bespoke auth build. [VERIFY]