SAML with Auth0 - TrueFoundry Docs

This guide walks you through setting up SAML 2.0 single sign-on between TrueFoundry and Auth0. Once finished, members of your Auth0 tenant can sign in to TrueFoundry through a Login with Auth0 button. For OpenID Connect instead of SAML, see OIDC with Auth0.

Prerequisites

A TrueFoundry tenant with Admin access to Settings → Security & Access → SSO.
An Auth0 tenant with permission to create Applications and configure Addons.

You’ll bounce between the Auth0 dashboard and the TrueFoundry SSO settings. Keep both open in adjacent tabs to copy-paste values quickly.

Configuration overview

Create the SSO configuration in TrueFoundry

Save a SAML SSO configuration in TrueFoundry to surface the Application Callback URL and audience values Auth0 needs.

Create an Auth0 application

Enable the SAML2 Web App addon in Auth0

Point the addon at TrueFoundry’s SP metadata and map email and sub.

Paste Auth0's IdP details into TrueFoundry

Copy the Identity Provider Login URL and signing certificate into the TrueFoundry SSO form.

Test sign-in

Verify that an Auth0 user can complete a SAML round-trip.

Step 1 — Create the SSO configuration in TrueFoundry

Open SSO settings

Go to Settings → Security & Access → SSO.Click the + icon labeled Add New SSO Config.

TrueFoundry SSO settings page with the Add New SSO Config plus button highlighted — SSO page in TrueFoundry — click the + icon to add a new SSO configuration

Fill in the basic fields

Enabled: turn this on.
Name: a lowercase alphanumeric label — for example, auth0saml.
SSO Provider: choose Custom.
Authentication Configuration: select SAML v2.

Leave Identity Provider Endpoint and X.509 Certificate blank for now — you’ll fill them in once Auth0 surfaces those values.

Save to reveal the Single sign-on URL, Audience URI (SP Entity ID), and Relay URL

Click Save. TrueFoundry displays the values you need for Auth0 on the SSO configuration card:

Auth0 field	Value from TrueFoundry
Application Callback URL	Single Sign On URL
`audience` in addon Settings JSON	Audience URI (SP Entity ID)
Relay State (if used)	Relay URL

TrueFoundry SSO configuration card displaying Audience URI, Single Sign On URL, Metadata URL, and Relay URL for SAML setup — TrueFoundry SSO configuration card showing the SAML values to copy into Auth0

Step 2 — Create an Auth0 application

Open Applications

Create a new application

Click + Create Application. Enter a Name such as TrueFoundry, select Regular Web Applications, and click Create.

Auth0 Applications page with the Create Application button highlighted — Applications page — click + Create Application

Step 3 — Enable the SAML2 Web App addon

Back in your Auth0 application, open the Addons tab.

Enable SAML2 WEB APP

Locate the SAML2 WEB APP tile and click it. The Addon: SAML2 Web App dialog opens on the Settings tab.

Auth0 application Addons tab showing the SAML2 WEB APP tile — Addons tab — open SAML2 WEB APP

Set the Application Callback URL

In the Application Callback URL field, paste the Single Sign On URL from TrueFoundry (from Step 1).

Configure the addon settings JSON

Below the callback URL is a Settings code editor that accepts a JSON object. Paste the snippet below, replacing the audience value with the Audience URI (SP Entity ID) from TrueFoundry:

{
  "audience": "<paste-truefoundry-Audience-URI-SP-Entity-ID-here>",
  "mappings": {
    "email": "email",
    "sub": "user_id",
    "given_name": "given_name",
    "family_name": "family_name",
    "name": "name"
  },
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ]
}

The defaults work for most setups. The mappings block above renames the SAML attributes to match what TrueFoundry looks for out of the box, and forces email to be the SAML NameID.

Auth0 Addon SAML2 Web App Settings tab showing Application Callback URL and the Settings JSON editor with audience and mappings — Addon Settings — Application Callback URL and Settings JSON

Enable the addon

Scroll to the bottom of the dialog and click Enable, then Save.

Step 4 — Copy Auth0’s IdP details into TrueFoundry

Re-open the Addon: SAML2 Web App dialog and switch to the Usage tab.

Copy the Identity Provider Login URL

From the Usage tab, copy the Identity Provider Login URL. This is the SSO endpoint TrueFoundry will redirect to.

Copy the Identity Provider Certificate

Click Download next to Identity Provider Certificate (or copy the <X509Certificate> block from the metadata XML).Open the downloaded .pem file in a text editor and copy the entire contents — including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

Auth0 Addon SAML2 Web App Usage tab showing Identity Provider Login URL and Download Auth0 certificate link — Addon Usage — Identity Provider Login URL and certificate download

Paste into TrueFoundry

Return to Settings → Security & Access → SSO in TrueFoundry, edit the SSO configuration you created in Step 1, and set:

Identity Provider Endpoint → the Identity Provider Login URL from Auth0.
X.509 Certificate → the certificate text you copied from the .pem file.

Click Save.

Step 5 — Test single sign-on

Open a private/incognito window and go to your TrueFoundry login page.
Click Login with Auth0 (or whichever button label you chose under Show advanced fields → Button Text).
Authenticate with an Auth0 user.

If sign-in succeeds you’ll land in the TrueFoundry dashboard. New users are created automatically if JIT provisioning is enabled; otherwise the user must already exist in TrueFoundry or be invited.

Optional next steps

Use OIDC instead of SAML — see OIDC with Auth0 for the equivalent OpenID Connect flow.

Troubleshooting

'Invalid Signature' or 'Could not validate SAML response'

The certificate copied into TrueFoundry doesn’t match Auth0’s signing certificate. Re-download the Identity Provider Certificate from the addon’s Usage tab and paste the full PEM (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines) into TrueFoundry.If you’re pasting from the metadata XML directly, wrap the bare base64 inside the BEGIN/END markers before saving.

'AudienceRestriction' mismatch error

The audience value inside the Auth0 addon’s Settings JSON must exactly match TrueFoundry’s Audience URI (SP Entity ID). Re-copy the value from the TrueFoundry SSO configuration card and update the addon settings.

Auth0’s default SAML mappings emit http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress rather than email. Either:

Keep the mappings block from Step 3 (which renames the attribute to email), or
Expand Show advanced fields in TrueFoundry and set Email Claim to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

​Prerequisites

​Configuration overview

​Step 1 — Create the SSO configuration in TrueFoundry

​Step 2 — Create an Auth0 application

​Step 3 — Enable the SAML2 Web App addon

​Step 4 — Copy Auth0’s IdP details into TrueFoundry

​Step 5 — Test single sign-on

​Optional next steps

​Troubleshooting

Prerequisites

Configuration overview

Step 1 — Create the SSO configuration in TrueFoundry

Step 2 — Create an Auth0 application

Step 3 — Enable the SAML2 Web App addon

Step 4 — Copy Auth0’s IdP details into TrueFoundry

Step 5 — Test single sign-on

Optional next steps

Troubleshooting