SSO: Auth0

This article describes how to configure Auth0 as your workplace's single sign-on identity provider (IdP). This process involves making modifications to your Auth0 environment and your digital workplace. Once complete, users of your digital workplace will be able to sign in to it using their Auth0 credentials.

To follow this process, you must be able to add applications to your Auth0 environment and be a workplace administrator in your digital workplace.

Sections in this article:

• Configuring an Auth0 single sign-on application
• Configuring your digital workplace's single sign-on

Configuring an Auth0 single sign-on application

Follow these steps to configure a SAML app in your Auth0 environment:

1. From your Auth0 dashboard, select the Applications option from the navigation menu.
2. While on the Applications page, select + Create Application.
3. In the provided Create Application window, enter a name for this new application, select Native as the application type, and then select Create.
4. Go to the Addons tab of your application. You can get to this page by going to your applications page (accessed from the sidebar navigation menu) and selecting Addons (</>), located in the row next to the application you created.
5. While on the Addons page, select SAML2 WEB APP.
6. In the provided SAML2 Web App window, enter the Application Callback URL of your digital workplace, and then select Enable. Your Application Callback URL (Igloo SAML endpoint) is your digital workplace URL followed by /saml.digest. For example, https://yourdigitalworkplace.com/saml.digest.
7. Go to the Rules page. You can find a link to this page on the sidebar navigation menu.
8. While on the Rules page, select + Create Rule.
9. Find and select the Remove attribute from a user rule. 
10. Replace the default script of the Remove attribute from a user rule with:

    function (user, context, callback) {
      const blacklist = [ 'picture', 'user_id' ];
    
      Object.keys(user).forEach(function(key) {
        if (blacklist.indexOf(key) > -1) {
          delete user[key];
        }
      });
    
      callback(null, user, context);
    }

11. Save this rule change.
12. Go to the Rules page. You can find a link to this page on the sidebar navigation menu.
13. While on the Rules page, select + Create Rule.
14. Find and select the SAML Attributes mapping rule. 
15. Replace the default script of the SAML Attributes mapping rule with:

    function (user, context, callback) {
      context.samlConfiguration.mappings = {
         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "email",
         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress":   "email",
         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname":           "user_metadata.given_name",
         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname":        "app_metadata.family_name"
      };
    
      callback(null, user, context);
    }

16. Save this rule change.
17. Go to the Settings tab of your application. You can get to this page by going to your applications page (accessed from the sidebar navigation menu) and selecting Settings (cog icon) located in the row next to the application you created.
18. Scroll to the bottom of the Settings tab and select Show Advanced Settings.
19. Go to the Certificate tab of Advanced Settings and select Download Certificate (as a PEM file). You will need this when configuring single sign-on in your digital workplace.
20. Go to the Endpoints tab of Advanced Settings and copy the SAML Protocol URL. You will need this when configuring single sign-on in your digital workplace.

Configuring your digital workplace's single sign-on

1. Go to your digital workplace and sign in.
2. Select  Control Panel.
3. Under Membership, select Sign In Settings.
4. Select Configure SAML Authentication.
5. Configure the settings as described in the Configuration settings table below.
6. Select Save.

 https://dev-80ve8rc0.auth0.com/logout