Inbound Single Sign-On
For inbound Single Sign-On (SSO) implementations, Auth0 is the SSO service provider. When a user logs in to an application:
The application presents the user with one or more external identity providers.
The user selects an identity provider to authenticate with and logs in.
Upon successful authentication, the user is returned to the application with an active session.
Inbound SSO in Auth0 is handled by connections.
Auth0 SSO sessions vs. application sessions
When users log in, various session layers can be created. For inbound SSO implementations, it's important to understand that the SSO experience is made possible by the Auth0 Session Layer, which is stored centrally on the Authorization Server. Leveraging this session layer, users can easily authenticate to different applications, each of which may have its own application session to track whether the user is logged into it specifically.
Build your own implementations
Social Identity Providers
Add a generic OAuth2 Authorization Server to Auth0
Auth0 provides instructions to configure the following SAML identity providers with Auth0:
We also provide generic instructions to configure Auth0 as a SAML service provider.
Native applications can only use Universal Login.
OpenID Connect (OIDC) does not support identity provider-initiated SSO.