SAML Identity Provider Configuration Settings

Reference for the SAML identity provider metadata Auth0 exposes, including the post-back URL, entity ID, and signing certificate needed to configure your IdP.

Common settings

These are the settings used to configure a SAML identity provider (IdP).

If you have configured a Custom Domain, you must use your custom domain CNAME in place of the Auth0 domain. To learn more, read Configure Features to Use Custom Domains.

Post-back URL

When using IdP-Initiated SSO, make sure to include the connection parameter in the post-back URL:

If you are using the Organizations feature, you can optionally include an organization parameter containing the organization ID of the desired organization:

In order for users to successfully log-in using this method, the connection must be enabled for the Organization. Additionally, you must either configure auto-membership for the enabled connection or ensure users have membership for the Organization.

Entity ID

The ID of the service provider is:

urn:auth0:{yourTenant}:{yourConnectionName}

You can create a custom Entity ID using the property connection.options.entityId. To learn more, read Specify a Custom Entity ID.

You can obtain the custom Entity ID value using the Get a Connection endpoint:

Using the Auth0 CLI? If you haven’t already, set up and authenticate your CLI session before running this command.

Replace the {yourAccessToken} placeholder in the authorization header with a Management API v2 access token.

SAML Request Binding

Also called the Protocol Binding, is sent to the IdP from Auth0. If possible, dynamically set the value based on connection.options.protocolBinding:

connection.options.protocolBinding value	SAML Request Binding value
Empty value ("") or not present	HTTP-Redirect
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect	HTTP-Redirect
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST	HTTP-POST

If dynamically setting the value isn’t possible, then set as either HTTP-Redirect (default) or HTTP-Post if you selected this option in Protocol Binding.

SAML Response Binding

How the SAML token is received by Auth0 from the IdP; set this as HTTP-POST.

NameID format

Unspecified.

SAML assertion and response

The SAML assertion, and the SAML response can be individually or simultaneously signed.

SingleLogout service URL

This is where the SAML identity provider will send logout requests and responses:

SAML logout requests must be signed by the identity provider.

Signed assertions

Use the following URLs to obtain the public key in different formats. Replace {yourDomain} with your Auth0 domain (or custom domain) and {yourConnectionName} with your connection name:

Format	URL
CER	https://{yourDomain}/cer?cert={yourConnectionName}
PEM	https://{yourDomain}/pem?cert={yourConnectionName}
raw PEM	https://{yourDomain}/rawpem?cert={yourConnectionName}
PKCS#7	https://{yourDomain}/pb7?cert={yourConnectionName}
Fingerprint	https://{yourDomain}/fingerprint?cert={yourConnectionName}

Download the certificate in the format requested by the IdP.

IdP-initiated Single Sign-on

To learn about IdP-initiated SSO, read Configure SAML IdP-Initiated Single Sign-On.

Metadata

Some SAML identity providers can accept importing metadata directly with all the required information. You can access the metadata for your connection in Auth0 here:

Organizations

Use the ACS URL for your organization in the federated IdP to start the Organizations login flow.

Learn more

• Locate the Connection ID or Name
• Customize SAML Assertions