Auth0 SAML Implementation

This article contains Auth0-specific help for configuring Login with SSO via SAML 2.0. For help configuring login with SSO for another IdP, refer to SAML 2.0 Configuration.

Configuration involves working simultaneously within the Bitwarden web app and the Auth0 Portal. As you proceed, we recommend having both readily available and completing steps in the order they are documented.

Log in to the Bitwarden web app and open the Admin Console using the product switcher:

Open your organization's Settings → Single sign-on screen:

If you haven't already, create a unique SSO identifier for your organization and select SAML from the the Type dropdown. Keep this screen open for easy reference.

You can turn off the Set a unique SP entity ID option at this stage if you wish. Doing so will remove your organization ID from your SP entity ID value, however in almost all cases it is recommended to leave this option on.

In the Auth0 Portal, use the Applications menu to create a Regular Web Application:

Click the Settings tab and configure the following information, some of which you will need to retrieve from the Bitwarden Single Sign-On screen:

Grant Types

In the Advanced Settings → Grant Types section, ensure that the following Grant Types are selected (they may be pre-selected):

Certificates

In the Advanced Settings → Certificates section, copy or download up your signing certificate. You won't need to do anything with it just yet, but you will need to reference it later.

Endpoints

You don't need to edit anything in the Advanced Settings → Endpoints section, but you will need the SAML endpoints to reference later.

Create actions to customize the logic that Auth0 will use during the post-login flow and dictate the parameters of the exchange with Bitwarden. To create the necessary action:

1. Navigate to Actions → Library and select Create Action → Build from scratch.

2. Give you action a name like Bitwarden SSO, chose the Login / Post Login Trigger, choose the Node 18 (Recommended) Runtime option, and select Create.

3. In the integrated code editor, add the following rule:

   JavaScriptCopy
   exports.onExecutePostLogin = async (event, api) => {
       // Modify SAML configuration settings
       if (event.request.protocol === 'samlp') {
           api.saml.updateConfiguration({
               signatureAlgorithm: "rsa-sha256",
               digestAlgorithm: "sha256",
               signResponse: true,
               nameIdentifierFormat: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
               binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
           });
       }
   };

4. Select Deploy.

5. Navigate to Actions → Triggers and select the post-login trigger.

6. Drag and drop your new action into the Post Login flow and select Apply.

When configuring the above action, you can customize any of the following attributes to fit your needs:

On November 18, 2024 Auth0 will deprecate rules. If you are currently using a rule as described in a previous version of this document, you can use a Migrate to Action button on the Auth0 Rules screen to make this process easier. If you do this:

• Do not toggle the pre-existing rule off.

• Do add the new action to your post-login trigger as described above in steps 5 & 6.

At this point, you have configured everything you need within the context of the Auth0 Portal. Return to the Bitwarden web app to complete configuration.

The Single sign-on screen separates configuration into two sections:

• SAML service provider configuration will determine the format of SAML requests.

• SAML identity provider configuration will determine the format to expect for SAML responses.

Unless you have configured custom rules, your service provider configuration will already be complete. If you configured custom rules or want to make further changes to your implementation, edit the relevant fields:

When you are done with the service provider configuration, Save your work.

Identity provider configuration will often require you to refer back to the Auth0 Portal to retrieve application values:

When you are done with the identity provider configuration, Save your work.

Once your configuration is complete, test it by navigating to https://vault.bitwarden.com, entering your email address, selecting Continue, and selecting the Enterprise Single-On button:

Enter the configured organization identifier and select Log In. If your implementation is successfully configured, you will be redirected to the Auth0 login screen:

After you authenticate with your Auth0 credentials, enter your Bitwarden master password to decrypt your vault!