Auth0 (SAML / OIDC)

Configure SSO with Auth0 using SAML or OIDC protocols.

This guide explains how to configure SSO integration between Trust and Auth0. After configuring Auth0, return to the Trust SSO Configuration Guide to complete the setup.

Before you begin: Access Trust and copy the Identifier and Reply URL fields as described in Step 2 of the SSO Configuration Guide.

---

Prerequisites

• Administrator access to Auth0
• Administrator access to Trust
• Verified corporate email domain

---

Choose the Protocol

SAML

SAML Configuration

Create Application in Auth0

1. Access the Auth0 Dashboard
2. Navigate to Applications → Applications
3. Click Create Application

Auth0 - Create Application

1. Configure the Name (e.g., "Trust - Caf")
2. Select Regular Web Applications and click Create

Auth0 - Select application type

Enable SAML

1. In the created application, access the Addons tab
2. Locate SAML2 Web App and click to enable
3. Click on SAML2 Web App after enabling

Auth0 - Addons SAML

1. In the settings tab, in the Application Callback URL field, paste the Reply URL from Trust

Auth0 - SAML Settings JSON

1. Configure the JSON:
2. In the audience field, enter the Trust Identifier URL and configure the mappings

{
  "audience": "Identifier URL",
  "mappings": {
    "email": "email",
    "name": "name",
    "given_name": "given_name",
    "family_name": "family_name"
  },
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ]
}

1. Scroll to the end of the Settings tab and click Save

Get Metadata URL

1. Access the Usage tab
2. Locate the Identity Provider Login URL
3. Build the Metadata URL by adding /metadata before the client ID:

Field	Format
Identity Provider Login URL	https://{your-domain}/samlp/{client-id}
Metadata URL	https://{your-domain}/samlp/metadata/{client-id}

Example: If the Identity Provider Login URL is https://dev-abc123.us.auth0.com/samlp/xyz789, the Metadata URL will be https://dev-abc123.us.auth0.com/samlp/metadata/xyz789.

Auth0 - SAML Metadata URL

OIDC

OIDC Configuration

Create Application in Auth0

1. Access the Auth0 Dashboard
2. Navigate to Applications
3. Click Applications
4. Click Create Application

Auth0 - Create Application

1. Configure the Name (e.g., "Trust - Caf")
2. Select Regular Web Applications and click Create

Auth0 - Select application type

Configure Application Settings

In the application's Settings tab, configure:

Auth0 Field	Value
Allowed Callback URLs	Paste the Reply URL copied from Trust

Auth0 - Application Settings

Click Save.

Get Credentials

In the same Settings tab, copy the following information:

Auth0 Field	Use in Trust as
Domain	Use to build the Issuer URL
Client ID	Client ID
Client Secret	Client Secret

Auth0 - Client Credentials

Get Issuer URL

The Auth0 Issuer URL follows the format:

https://{your-domain}/

---

Enable Connections and Users

In Auth0, user access to the application is controlled by enabled Connections. A Connection is the source of user identity (internal database, social login, corporate directory, etc.).

Enable Connections in the Application

1. In the created application, access the Connections tab
2. Enable the connections where your users are registered

Auth0 - Connections

Connection Type	Description
Database	Users registered directly in Auth0 (e.g., Username-Password-Authentication)
Social	Login via social providers (Google, Microsoft, etc.)
Enterprise	Corporate connections (SAML, OIDC, Azure AD, etc.)

Important: If the Connection where the user is registered is not enabled for the application, the user will not be able to log in.

Next Steps

After configuring Auth0, return to the Trust SSO Configuration Guide to:

1. Configure Properties and Scopes
2. Configure Permission Groups
3. Configure Attribute Statements
4. Configure Domains
5. Save and Test

---

Troubleshooting

Problem	Probable Cause	Solution
Callback URL error	URL does not match	Verify that the reply URL is exactly the same in Allowed Callback URLs
Invalid token	Incorrect Client Secret	Regenerate the Client Secret in Auth0 and update it in Trust
Groups not received	Action not configured	Configure the Action to include groups in tokens/assertions
Invalid SAML assertion	Incorrect audience	Verify that the audience in the addon JSON matches the Trust Identifier
User not found	Connection not enabled	Check the enabled connections in the Connections tab

---

References

• Auth0 Documentation - SAML
• Auth0 Documentation - OIDC
• Configure Actions
• Add custom claims