Integrating with Auth0

This article explains how to connect your Auth0 tenant to Valven for single sign-on over SAML 2.0, using Auth0's SAML2 Web App add-on.

You'll need admin access to your Auth0 tenant, and permission to change SSO settings in Valven.

Connect Your Application

Visit Settings → Single Sign-On on the Valven sidebar, and open the Auth0 tab. The panel on the right — “Set these in Auth0” — gives you the Identifier (Entity ID), Reply URL (ACS), and Sign on URL you'll need below:

Create an Application

Step 1: In the Auth0 dashboard, go to Applications → Applications → Create Application.

Step 2: Give it a name and choose Regular Web Applications.

Step 3: Click Create.

Enable the SAML2 Web App Add-on

Step 1: On the application's page, go to the Addons tab and toggle on SAML2 Web App.

Step 2: Set Application Callback URL to the Reply URL (ACS) value from the Valven panel.

Paste the following into the Settings (JSON) box, replacing the audience value with the Identifier (Entity ID) value from Valven:

{

  "audience": "https://platform.valven.com/saml2/metadata/test-company-auth0",

  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",

  "nameIdentifierProbes": [

    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"

  ],

  "signatureAlgorithm": "rsa-sha256"

}

Step 3: Click Save.

Import the Metadata into Valven

Note the Client ID from the application's Settings tab, then open the following URL in your browser:

Copy the full XML content and paste it into the Federation metadata XML box on the Valven Auth0 tab.

Pass Through First and Last Name

Auth0's standard user profile keeps a single “name” field, not separate first/last name fields. Add these to the User Metadata field when creating a user:

Add a Custom Action for Groups/Roles

Auth0 does not include a user's roles in the SAML response by default — this requires a small Action.

Step 1: Go to Actions → Library → Build Custom, using Login / Post Login as the trigger.

Step 2: Paste the code below. You can replace the address on the last block with any unique address of your choosing:

Step 3: Click Deploy.

Step 4: Go to Actions → Triggers →post-login, find your Action under the Custom tab, and drag it into the flow line (between Start and Complete).

Step 5: Click Apply.

Important: the address you use in the code must be an exact match for the value you enter into Valven's “Groups or Roles Claim” field.

Create a Test User and Role

Step 1: Go to User Management → Roles → Create Role, using a name that matches a role in Valven.

Step 2: From the role's Users tab, add the relevant user(s).

Step 3: Go to User Management → Users → Create User, using a strong password.

Step 4: Open the user's profile and add the first/last name information from Step 4 to User Metadata.

Verifying the Connection

From the Valven sign-in page, enter the test user's email address and choose “Sign in with SSO” — you should land on Auth0's login screen. Signing in with the test user from Step 6 should bring you back to Valven with the correct name and role.

Common Errors

• “Password is too weak”: use at least 8 characters mixing upper/lowercase letters, digits, and special characters.
• “No attribute was found to generate the nameIdentifier”: revisit "Enable the SAML2 Web App Add-on" step, use the fully-qualified claim URI in nameIdentifierProbes, not a short name.
• Role or group information doesn't reach Valven: confirm the Action was deployed and is attached to the Login flow, that the test user is actually assigned the role, and that the claim address matches exactly.