Tutorial: How to Configure SAML with Auth0
Overview
Access Server supports authentication using SAML with Auth0 as the identity provider. You can configure this in Auth0 with Access Server as your service provider.
The following steps walk you through enabling SAML authentication for users and groups from Auth0 to Access Server.
You need the following to get started:
An Auth0 account.
A deployed Access Server.
With Auth0, you must create a custom SAML application.
First, gather information about your Access Server as the service provider (SP).
Sign in to your Access Server Admin Web UI.
Select Authentication → SAML.
You'll need the following information:
SP Identity.
SP ACS.
Now that you have your SP information, you can create a new Auth0 SAML app and enter that information during app creation:
Sign in to your Auth0 portal.
Under Applications, click Applications.
Click Create Application.
Enter a name for your SAML custom app.
Under Choose an application type, click Native, and click Create.
Under the Settings tab, scroll down until Application URIs, and use the SP information from Access Server to enter the following into the Auth0 app:
Application Login URI: Enter the Access Server SAML SP Identity.
Allow Callback URLs: Enter the Access Server SP ACS. (Ensure you enter https:// with the SAML Hostname.)
Scroll down and click Save Changes.
Option 1: Download the Auth0 metadata file for automatic configuration
Under Applications, click Applications.
Click on your SAML app.
Under Addons, click on SAML2 Web App.
Under the Usage tab and Identity Provider Metadata, click Download.
Option 2: Copy the Auth0 SAML data for manual configuration
Under Applications, click Applications.
Click on your SAML app.
Under Addons, click on SAML2 Web App.
Under the Usage tab, copy the content of Issuer, and Identity Provider Login URL.
Click Identity Provider Certificate to download the certificate in PEM format.
The simplest way to set up Auth0 SAML for Access Server is by providing the metadata XML file (option 1), but you can also manually configure it (option 2).
Option 1: Upload the Auth0 metadata file in the Admin Web UI
Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:
Sign in to the Admin Web UI.
Select Authentication.
Select the SAML tab.
Set Enable SAML authentication to Enabled.
Under Configure Identity Provider (IdP), Select Configure using metadata URL/file.
The Configure using metadata modal displays.
Click Click to upload to select your XML file or drag and drop it into the modal window.
The Identity Provider data populates the corresponding fields.
Select Save and Restart.
Option 2: Manually configure Auth0 SAML
Sign in to the Admin Web UI.
Select Authentication.
Select the SAML tab.
Set Enable SAML authentication to Enabled.
Under Configure Identity Provider (IdP), manually enter the Auth0 configuration data into the appropriate fields:
Paste the Auth0 Issuer into Access Server’s IdP Entity ID.
Paste the Auth0 Identity Provider Login URL into Access Server’s SSO (Single Sign-On) Endpoint.
Paste the Auth0 Identity Provider Certificate into Access Server’s Certificate (PEM format).
Select Save and Restart.
You can now enable SAML as the global default authentication or for specific groups and users.
You can automate group assignments for access control rules using a post-authentication Python script.
Refer to the steps in this tutorial: