Skip to main content

Log in with Auth0

This source lets users authenticate with their Auth0 credentials by configuring Auth0 as a federated identity provider using SAML or OpenID Connect (OIDC).

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.
  • company.auth0.com is the domain of your Auth0 tenant.
  • <auth0-slug> is the slug of the source in authentik (for example, auth0).

Configuration methods​

You can integrate Auth0 with authentik using either SAML or OpenID Connect (OIDC). Select a tab below for the corresponding instructions.

SAML​

Export the authentik signing certificate​

Auth0 needs the public certificate of an authentik keypair to verify signed requests from authentik and to encrypt assertions.

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to System > Certificates.
  3. Click the certificate that you want to use for signing and encryption, for example, the default authentik Self-signed Certificate.
  4. Click Download Certificate.

To encrypt assertions, Auth0 requires the public key in a separate file in addition to the certificate. The certificate already contains the public key. Use the following OpenSSL command to extract it into a separate file.

openssl x509 -in authentik\ Self-signed\ Certificate_certificate.pem -pubkey -noout > public_key.pem

Auth0 configuration​

Create an application with the SAML2 Web App addon​

  1. Log in to the Auth0 Dashboard as an administrator.

  2. Navigate to Applications > Applications and click Create Application.

  3. Set the name to authentik, select Regular Web Applications, and click Create.

  4. On the Settings tab, take note of the Client ID. This value will be required when configuring encryption.

  5. Navigate to the Addons tab and enable SAML2 Web App.

  6. On the addon's Settings tab, configure the following settings:

    • Application Callback URL: https://authentik.company/source/saml/<auth0-slug>/acs/
    • Settings: paste the following JSON. Replace the signingCert value with the contents of the authentik certificate that you exported earlier. Format the certificate as a single line by replacing each line break with \n. Auth0 uses this certificate to verify signatures on requests from authentik.
    {
        "audience": "https://authentik.company/source/saml/<auth0-slug>/metadata/",
        "nameIdentifierFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
        "signatureAlgorithm": "rsa-sha256",
        "digestAlgorithm": "sha256",
        "mappings": {
            "email": "email"
        },
        "signingCert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n"
    }

  7. Click Enable to save the addon settings.

  8. On the addon's Usage tab, take note of the Identity Provider Login URL, and then click Download Auth0 certificate. You will need the URL and certificate to configure authentik.

Configure assertion encryption​

Auth0 encrypts assertions using a post-login Action rather than an addon setting.

  1. Navigate to Actions > Library and click Create Action > Create custom action.

  2. Set the name to SAML encryption, set Trigger to Login / Post Login, and click Create.

  3. Paste the following code. Replace <client_id> with the Client ID of the application that you created earlier. Replace the example certificate and public key with the contents of the files that you exported earlier:

    exports.onExecutePostLogin = async (event, api) => {
        if (event.client.client_id === "<client_id>") {
            const encryptionCert = `-----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----`;
            const encryptionPublicKey = `-----BEGIN PUBLIC KEY-----
    ...
    -----END PUBLIC KEY-----`;
            api.samlResponse.setEncryptionCert(encryptionCert);
            api.samlResponse.setEncryptionPublicKey(encryptionPublicKey);
            api.samlResponse.setEncryptionAlgorithm("aes256-gcm");
        }
    };

  4. Click Deploy.

  5. Navigate to Actions > Triggers and select post-login.

  6. Drag the SAML encryption Action into the flow and click Apply.

authentik configuration​

Upload the Auth0 certificate to authentik​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to System > Certificates and click Import.
  3. Set Name to Auth0 Signing Certificateor similar.
  4. Paste the contents of the Auth0 certificate you downloaded earlier into the Certificate field.
  5. Leave the Private Key field empty.
  6. Click Create.

Create a SAML source in authentik​

  1. Navigate to Directory > Federation and Social login and click New Source.
  2. Select SAML Source and configure the following settings:
    • Set Name to Auth0.
    • Set Slug to auth0.
    • Set SSO URL to the Identity Provider Login URL from Auth0 (https://company.auth0.com/samlp/<client_id>).
    • Set SLO URL to the Identity Provider Login URL with /logout appended (https://company.auth0.com/samlp/<client_id>/logout).
    • Set Service Provider Binding to Post (Auto-Submit).
    • Set Signing keypair to the authentik certificate you exported earlier.
    • Set Verification Certificate to the Auth0 certificate you uploaded earlier.
    • Enable Verify Assertion Signature.
    • Under Advanced protocol settings, set Encryption Certificate to the authentik certificate you exported earlier. Its private key is used to decrypt the assertions encrypted by Auth0.
  3. Click Finish.
Display new source on login screen

For instructions on how to display the new source on the authentik login page, refer to the Add sources to default login page documentation.

Embed new source in flow Enterprise

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the Source Stage documentation.

Source property mappings​

Source property mappings allow you to modify or gather extra information from sources. See the overview for more information.

Resources​