Auth0 SAML

Learn how to configure Auth0 SAML for Infisical SSO.

Auth0 SAML SSO feature is a paid feature. If you’re using Infisical Cloud, then it is available under the Pro Tier. If you’re self-hosting Infisical, then you should contact [e-mail] to purchase an enterprise license to use it.

1. Prepare the SAML SSO configuration in Infisical

   In Infisical, head to the Single Sign-On (SSO) page and select the General tab. Click Connect for SAML under the Connect to an Identity Provider section. Select Auth0, then click Connect again.

   

   Next, note the Application Callback URL and Audience to use when configuring the Auth0 SAML application.

   

2. Create a SAML application in Auth0

   2.1. In your Auth0 account, head to Applications and create an application.

   

   Select Regular Web Application and press Create.

   

   2.2. In the Application head to Settings > Application URIs and add the Application Callback URL from step 1 into the Allowed Callback URLs field.

   

   2.3. In the Application head to Addons > SAML2 Web App and copy the Issuer, Identity Provider Login URL, and Identity Provider Certificate from the Usage tab.

   

   2.4. Back in Infisical, set Issuer, Identity Provider Login URL, and Certificate to the corresponding items from step 2.3.

   

   2.5. Back in Auth0, in the Settings tab, set the Application Callback URL to the Application Callback URL from step 1 and update the Settings field with the JSON under the picture below (replacing <audience-from-infisical> with the Audience from step 1).

   

   {
   "audience": "<audience-from-infisical>",
   "mappings": {
       "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email",
       "given_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstName",
       "family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/lastName"
   },
   "signatureAlgorithm": "rsa-sha256",
   "digestAlgorithm": "sha256",
   "signResponse": true
   }
   

   Click Save.

   Make sure the firstName claim is mapped to a valid field of your Auth0 users. If your users don’t have a "given_name" field available, you can replace it with "name" or another field that exists in your user profile on the left side of the mapping.

3. Enable SAML SSO in Infisical

   Enabling SAML SSO allows members in your organization to log into Infisical via Auth0.

   

4. Enforce SAML SSO in Infisical

   Enforcing SAML SSO ensures that members in your organization can only access Infisical by logging into the organization via Auth0.

   To enforce SAML SSO, you’re required to test out the SAML connection by successfully authenticating at least one Auth0 user with Infisical; Once you’ve completed this requirement, you can toggle the Enforce SAML SSO button to enforce SAML SSO.

   In case of a lockout, an organization admin can use the Admin Login Portal in the /login/admin path e.g. https://app.infisical.com/login/admin.

If you are only using one organization on your Infisical instance, you can configure a default organization in the Server Admin Console to expedite SAML login.

If you’re configuring SAML SSO on a self-hosted instance of Infisical, make sure to set the AUTH_SECRET and SITE_URL environment variable for it to work:

• AUTH_SECRET: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with openssl rand -base64 32.

• SITE_URL: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. https://app.infisical.com)