> For the complete documentation index, see [llms.txt](https://docs.caf.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.caf.io/caf-docs/user-guide/trust-platform/sso-configurations/auth0.md).

# Auth0 (SAML / OIDC)

This guide explains how to configure SSO integration between Trust and Auth0. After configuring Auth0, return to the [Trust SSO Configuration Guide](/caf-docs/user-guide/trust-platform/sso-configurations.md) to complete the setup.

{% hint style="info" %}
**Before you begin:** Access Trust and copy the **Identifier** and **Reply URL** fields as described in [Step 2 of the SSO Configuration Guide](/caf-docs/user-guide/trust-platform/sso-configurations.md#passo-2-selecionar-protocolo-e-obter-dados).
{% endhint %}

***

## Prerequisites

* Administrator access to Auth0
* Administrator access to Trust
* Verified corporate email domain

***

## Choose the Protocol

{% tabs %}
{% tab title="SAML" %}

### SAML Configuration

#### Create Application in Auth0

1. Access the [Auth0 Dashboard](https://manage.auth0.com)
2. Navigate to **Applications** → **Applications**
3. Click **Create Application**

<div data-with-frame="true"><img src="/files/khFWPEnK69XZfVRq3sVS" alt="Auth0 - Create Application"></div>

4. Configure the **Name** (e.g., "Trust - Caf")
5. Select **Regular Web Applications** and click **Create**

<div data-with-frame="true"><img src="/files/4wDbvC4Z5TB4wZf9Hd6e" alt="Auth0 - Select application type"></div>

#### Enable SAML

1. In the created application, access the **Addons** tab
2. Locate **SAML2 Web App** and click to enable
3. Click on **SAML2 Web App** after enabling

<div data-with-frame="true"><img src="/files/EkPvcZUZGCIPmIeLO2Ms" alt="Auth0 - Addons SAML"></div>

4. In the **settings** tab, in the **Application Callback URL** field, paste the **Reply URL** from Trust

<div data-with-frame="true"><img src="/files/8ugkE1XhCK5mrj62wUEy" alt="Auth0 - SAML Settings JSON"></div>

5. Configure the JSON:
6. In the audience field, enter the Trust Identifier URL and configure the mappings

```json
{
  "audience": "Identifier URL",
  "mappings": {
    "email": "email",
    "name": "name",
    "given_name": "given_name",
    "family_name": "family_name"
  },
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ]
}
```

7. Scroll to the end of the **Settings** tab and click **Save**

#### Get Metadata URL

1. Access the **Usage** tab
2. Locate the **Identity Provider Login URL**
3. Build the **Metadata URL** by adding `/metadata` before the client ID:

| Field                           | Format                                             |
| ------------------------------- | -------------------------------------------------- |
| **Identity Provider Login URL** | `https://{your-domain}/samlp/{client-id}`          |
| **Metadata URL**                | `https://{your-domain}/samlp/metadata/{client-id}` |

{% hint style="info" %}
**Example:** If the Identity Provider Login URL is `https://dev-abc123.us.auth0.com/samlp/xyz789`, the Metadata URL will be `https://dev-abc123.us.auth0.com/samlp/metadata/xyz789`.
{% endhint %}

<div data-with-frame="true"><img src="/files/8NgXzLIGBWZtaAP1srNo" alt="Auth0 - SAML Metadata URL"></div>
{% endtab %}

{% tab title="OIDC" %}

### OIDC Configuration

#### Create Application in Auth0

1. Access the [Auth0 Dashboard](https://manage.auth0.com)
2. Navigate to **Applications**
3. Click **Applications**
4. Click **Create Application**

<div data-with-frame="true"><img src="/files/khFWPEnK69XZfVRq3sVS" alt="Auth0 - Create Application"></div>

4. Configure the **Name** (e.g., "Trust - Caf")
5. Select **Regular Web Applications** and click **Create**

<div data-with-frame="true"><img src="/files/4wDbvC4Z5TB4wZf9Hd6e" alt="Auth0 - Select application type"></div>

#### Configure Application Settings

In the application's **Settings** tab, configure:

| Auth0 Field               | Value                                     |
| ------------------------- | ----------------------------------------- |
| **Allowed Callback URLs** | Paste the **Reply URL** copied from Trust |

<div data-with-frame="true"><img src="/files/ZE1T2yKIkHOfLn0uiiTA" alt="Auth0 - Application Settings"></div>

Click **Save**.

#### Get Credentials

In the same **Settings** tab, copy the following information:

| Auth0 Field       | Use in Trust as             |
| ----------------- | --------------------------- |
| **Domain**        | Use to build the Issuer URL |
| **Client ID**     | Client ID                   |
| **Client Secret** | Client Secret               |

<div data-with-frame="true"><img src="/files/mkovt7m2PTjpvrl9Z0kO" alt="Auth0 - Client Credentials"></div>

#### Get Issuer URL

The Auth0 Issuer URL follows the format:

```
https://{your-domain}/
```

{% endtab %}
{% endtabs %}

***

## Enable Connections and Users

In Auth0, user access to the application is controlled by enabled **Connections**. A Connection is the source of user identity (internal database, social login, corporate directory, etc.).

### Enable Connections in the Application

1. In the created application, access the **Connections** tab
2. Enable the connections where your users are registered

<div data-with-frame="true"><img src="/files/v6WMr2bPkpm0urZKJh5o" alt="Auth0 - Connections"></div>

| Connection Type | Description                                                                   |
| --------------- | ----------------------------------------------------------------------------- |
| **Database**    | Users registered directly in Auth0 (e.g., `Username-Password-Authentication`) |
| **Social**      | Login via social providers (Google, Microsoft, etc.)                          |
| **Enterprise**  | Corporate connections (SAML, OIDC, Azure AD, etc.)                            |

{% hint style="warning" %}
**Important:** If the Connection where the user is registered is not enabled for the application, the user will not be able to log in.
{% endhint %}

## Next Steps

After configuring Auth0, return to the [Trust SSO Configuration Guide](/caf-docs/user-guide/trust-platform/sso-configurations.md) to:

1. [Configure Properties and Scopes](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-2-select-protocol-and-obtain-data)
2. [Configure Permission Groups](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-3-configure-permission-groups)
3. [Configure Attribute Statements](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-4-configure-attribute-statements)
4. [Configure Domains](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-5-configure-domains)
5. [Save and Test](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-6-save-and-test)

***

## Troubleshooting

| Problem                | Probable Cause          | Solution                                                                    |
| ---------------------- | ----------------------- | --------------------------------------------------------------------------- |
| Callback URL error     | URL does not match      | Verify that the reply URL is exactly the same in **Allowed Callback URLs**  |
| Invalid token          | Incorrect Client Secret | Regenerate the Client Secret in Auth0 and update it in Trust                |
| Groups not received    | Action not configured   | Configure the Action to include groups in tokens/assertions                 |
| Invalid SAML assertion | Incorrect audience      | Verify that the **audience** in the addon JSON matches the Trust Identifier |
| User not found         | Connection not enabled  | Check the enabled connections in the **Connections** tab                    |

***

## References

* [Auth0 Documentation - SAML](https://auth0.com/docs/authenticate/protocols/saml)
* [Auth0 Documentation - OIDC](https://auth0.com/docs/authenticate/protocols/openid-connect-protocol)
* [Configure Actions](https://auth0.com/docs/customize/actions)
* [Add custom claims](https://auth0.com/docs/get-started/apis/scopes/sample-use-cases-scopes-and-claims)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.caf.io/caf-docs/user-guide/trust-platform/sso-configurations/auth0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.