Integrate with Auth0

Support level: Community

What is Auth0?

Auth0 is an identity platform that provides authentication and authorization services for applications. It can delegate authentication to external identity providers via enterprise connections.

-- https://auth0.com

Preparation

The following placeholders are used in this guide:

• authentik.company is the FQDN of the authentik installation.
• company.auth0.com is the domain of your Auth0 tenant.

info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

Auth0 can delegate authentication to authentik using either SAML or OpenID Connect (OIDC). Choose one protocol and follow the matching tab throughout this guide.

OIDC

authentik configuration

To support the integration of Auth0 with authentik, you need to import the Auth0 encryption certificate and create an application/provider pair in authentik. In the provider settings below, <tenant_name> is the Auth0 tenant name and <connection_name> is the enterprise connection name that you will create in Auth0 (for example, authentik).

Import the Auth0 certificate

Auth0 uses its tenant keypair to decrypt assertions and to sign SAML requests. Import the public certificate into authentik so authentik can encrypt assertions for Auth0 and verify the signatures on requests from Auth0.

1. Download the Auth0 tenant certificate from https://company.auth0.com/pem?cert=connection.
2. Log in to authentik as an administrator and open the authentik Admin interface.
3. Navigate to System > Certificates and click Import.
4. Give it a name like Auth0 Certificate.
5. Paste the contents of the downloaded certificate into the Certificate field.
6. Leave the Private Key field empty.
7. Click Create.

Create an application and provider

SAML provider changes in authentik 2026.5

authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the Issuer value to: https://authentik.company/application/saml/<application_slug>/metadata/

Older versions of authentik set this value to authentik by default. If you're running an older version, please set Issuer to https://authentik.company/application/saml/<application_slug>/metadata/, where <application_slug> is the slug that you selected for the application.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to Applications > Applications and click New Application to open the application wizard.

   • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the Slug value because you will use it when configuring Auth0.
   • Choose a Provider type: select SAML Provider as the provider type.
   • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
     • ACS URL: https://company.auth0.com/login/callback?connection=<connection_name>
     • Audience: urn:auth0:<tenant_name>:<connection_name>
     • SLS URL: https://company.auth0.com/logout
     • SLS Binding: Redirect
     • Logout Method: Front-channel (Iframe).
     • Under Advanced protocol settings:
       • Select an available Signing Certificate.
       • Set Verification Certificate to the Auth0 certificate you imported earlier. authentik will then reject unsigned requests, so Sign Request must be enabled on the Auth0 connection.
       • Set Encryption Certificate to the Auth0 certificate you imported earlier.
   • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.

3. Click Submit to save the new application and provider.

Download the signing certificate

1. Navigate to Applications > Providers and click the name of the provider that you created in the previous section.
2. Under Related objects > Download signing certificate, click Download. This certificate will be required in the next section.

Auth0 configuration

To integrate authentik with Auth0, create a SAML enterprise connection in the Auth0 Dashboard.

1. Log in to the Auth0 Dashboard as an administrator.
2. Navigate to Authentication > Enterprise, find SAML, and click the Create button.
3. Configure the following settings:
   • Connection name: <connection_name>. This value cannot be changed later and must match the connection name used in the authentik ACS URL and Audience fields.
   • Sign In URL: https://authentik.company/application/saml/<application_slug>/
   • X.509 Signing Certificate: upload the authentik signing certificate that you downloaded earlier.
   • Enable Sign Out: enable this option.
   • Sign Out URL: https://authentik.company/application/saml/<application_slug>/
   • Under advanced settings, enable Sign Request so that authentik can verify the signature of requests from Auth0.
4. Click Create.
5. Navigate to the connection's Applications tab and enable the connection for each application that should allow logging in with authentik.

Allow the authentik encryption algorithm

authentik encrypts assertions using AES-128-CBC, which Auth0's default algorithm profile rejects. This setting is not available in the Auth0 Dashboard; allow the algorithm on the connection using the Update a Connection endpoint of the Auth0 Management API.

1. To get an API token, navigate to Applications > APIs > Auth0 Management API > API Explorer in the Auth0 Dashboard and copy the test token.

2. Fetch the connection's id and current options:

   curl -H "Authorization: Bearer <api_token>" \
       "https://company.auth0.com/api/v2/connections?strategy=samlp&name=<connection_name>" \
       --output auth0-connections.json

3. Add assertion_decryption_settings to the connection's existing options object and save the result as a PATCH request body:

   jq '.[0] | {
       options: (.options + {
           assertion_decryption_settings: {
               algorithm_profile: "v2026-1",
               algorithm_exceptions: ["http://www.w3.org/2001/04/xmlenc#aes128-cbc"]
           }
       })
   }' auth0-connections.json > auth0-connection-update.json

4. Copy the connection id from auth0-connections.json, then update the connection:

   curl -X PATCH "https://company.auth0.com/api/v2/connections/<connection_id>" \
       -H "Authorization: Bearer <api_token>" \
       -H "Content-Type: application/json" \
       --data @auth0-connection-update.json

Preserve existing connection options

Updating options replaces the entire object. The jq command above retains the existing options and adds assertion_decryption_settings; sending only the new property removes the other connection settings.

SAML

authentik configuration

To support the integration of Auth0 with authentik, you need to create an application/provider pair in authentik.

Create an application and provider

Redirect URI changes in authentik 2026.5

In authentik versions earlier than 2026.5, all Redirect URIs are automatically treated as Authorization type. If you are using one of these older authentik versions, add only the Authorization URL to your Redirect URIs and do not configure a Post Logout URI.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to Applications > Applications and click New Application to open the application wizard.

   • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the Slug value because you will use it when configuring Auth0.
   • Choose a Provider type: select OAuth2/OpenID Connect as the provider type.
   • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
     • Note the Client ID and Client Secret values because you will use them when configuring Auth0.
     • Add a Redirect URI of type Strict Authorization as https://company.auth0.com/login/callback.
     • Set Logout URI to https://company.auth0.com/logout.
     • Set Logout Method to Front-channel.
     • Select an RSA Signing Key.
   • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.

3. Click Submit to save the new application and provider.

Auth0 configuration

To integrate authentik with Auth0, create an OpenID Connect enterprise connection in the Auth0 Dashboard.

1. Log in to the Auth0 Dashboard as an administrator.
2. Navigate to Authentication > Enterprise, find Open ID Connect, and click the Create button.
3. Configure the following settings:
   • Purpose: select Authentication.
   • Connection name: enter a name, such as authentik. This value cannot be changed later.
   • OpenID Connect Discovery URL: https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration
   • Client ID: enter the Client ID from authentik.
   • Communication Channel: select Back Channel.
   • Client Secret: enter the Client Secret from authentik.
4. Click Create.
5. Navigate to the connection's Applications tab and enable the connection for each application that should allow logging in with authentik.

Configuration verification

To confirm that authentik is properly configured with Auth0, open the Auth0 Dashboard and navigate to Authentication > Enterprise. Open SAML or Open ID Connect, then select the Try arrow next to the connection. The connection must be enabled for at least one application, or Auth0 returns a the connection is not enabled error. Auth0 redirects you to authentik to authenticate, then displays an It works! page with the user profile that it received.

Resources

• Auth0 Docs — Connect Your App to SAML Identity Providers
• Auth0 Docs — Sign and Encrypt SAML Requests
• Auth0 Docs — Connect Your App to OpenID Connect Identity Providers
• Auth0 Docs — Configure Auth0 as SAML Service Provider
• Auth0 Docs — Log Users Out of SAML Identity Providers
• Auth0 Docs — Test Enterprise Connections