Cbox ID
Auth0
Auth0
Single sign-on (SAML 2.0)
In the portal, choose Auth0 under Enterprise SSO and Start with Auth0. Then, in Auth0:
- In the Auth0 Dashboard, go to Applications → Applications and create or open the application for this service.
- On the Addons tab, turn on SAML2 Web App.
- On its Settings tab, enter our ACS URL as the Application Callback URL.
- In the settings JSON, set audience to our entity ID, nameIdentifierFormat to the email address format, signatureAlgorithm to rsa-sha256 and digestAlgorithm to sha256 — Auth0 signs with SHA-1 otherwise.
- Save, then on the Usage tab download the Identity Provider Metadata (or copy https://<your-domain>/samlp/metadata/<client-id>).
The values the portal shows
| Auth0 field | Value |
|---|---|
| Application Callback URL (Addons → SAML2 Web App → Settings) | The portal's ACS URL (https://…/sso/saml/…/acs) |
| audience (Addons → SAML2 Web App → Settings (JSON)) | The portal's entity ID (https://…/sso/saml/…) |
| nameIdentifierFormat (Addons → SAML2 Web App → Settings (JSON)) | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress |
| signatureAlgorithm (Addons → SAML2 Web App → Settings (JSON)) | rsa-sha256 |
| digestAlgorithm (Addons → SAML2 Web App → Settings (JSON)) | sha256 |
What to bring back
Copy Identity Provider Metadata — the URL, or the XML — and paste it into the portal's Metadata URL or XML. Prefer the URL.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
Auth0's own guide: https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-identity-provider.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.