Auth0 single sign-on
Auth0 can be used to sign your colleagues in to 3rdRisk, so they reach the platform from your corporate identity instead of keeping a separate password. You configure it yourself in the platform, and nothing changes for your users until you switch it on.
This article covers the Auth0 side of the setup and the one field that only Auth0 uses. Everything that applies to every provider — how the connection test works, what happens to accounts that do not exist yet, and how to switch single sign-on on — is described in the main article.
Start here for the shared steps: Single sign-on
Overview
You create a regular web application in Auth0, copy two values out of it into 3rdRisk, paste one value back into Auth0, and add your Auth0 domain. Auth0 is the only provider that also uses the Token URL Path field.
Permissions needed: Configuration settings (read and update). To grant it, navigate to: Left menu: Configuration, then Roles.
Available for: an administrator of both systems. You need an Auth0 tenant administrator account and access to Configuration in 3rdRisk.
Note: single sign-on does not create accounts by itself. Either the person already exists in 3rdRisk, or you fill in Default roles so that they are created on their first sign-in.
1. Open the SSO settings in 3rdRisk
- Navigate to: Left menu: Configuration, then General, then the SSO tab.
- Set SSO Provider to Auth0.
The page then shows a Redirect URI, generated from your platform address. You need it in the next step. Leave this page open.
2. Create the application in Auth0
- Sign in to the Auth0 Dashboard as a tenant administrator.
- Open Applications, then Applications, then Create Application.
- Enter a name, for example
3rdRisk, choose Regular Web Applications, then Create. - On the application's Settings tab, copy the Domain, the Client ID and the Client Secret.
- Still on Settings, under Application URIs, paste the Redirect URI from the 3rdRisk SSO page into Allowed Callback URLs, then Save Changes.
3. Enter the details in 3rdRisk
Back on the SSO tab, fill in:
Field | Value |
|---|---|
SSO Provider | Auth0 |
Client ID | Client ID from the application's Settings tab |
Client Secret | Client Secret from the same tab |
Base URL | your Auth0 domain as a full address, for example |
Token URL Path |
|
Redirect URI | generated for you — this is the value you pasted into Auth0 |
Support Email | the address your own users should contact about sign-in problems |
Tenant ID is not used by Auth0. Leave it empty.
Click on Save.
4. Choose how users are identified
Under Identity provider, Username Type decides which value is matched against the account in 3rdRisk:
- Email address — the default, and the right choice for most organisations.
- User Principal Name (UPN) — use this only when you match on UPN deliberately.
Note: Auth0 identifies people by e-mail address, so leave this on Email address unless you have a specific reason not to.
5. Enable single sign-on
Once your settings are saved, switch Enable SSO on. Unlike Microsoft Entra ID, Auth0 does not require a connection test first — but running one anyway is the cheapest way to find a wrong secret or a mistyped callback URL before it affects everyone.
The test, its three possible results and the order of saving and enabling are described here: Single sign-on
Known limitations
- A connection test never stores the client secret. Save your settings before testing.
- The Base URL is a full address including
https://, and it is the Auth0 domain rather than a login URL. - The callback URL must match exactly. Auth0 compares it character for character, so paste it rather than retyping it.
- MFA is your provider's responsibility. The MFA enforcement setting on the SSO tab is specific to Microsoft Entra ID, and Require two-factor authentication for 3rdRisk sign-in applies only while the provider is 3rdRisk. With Auth0, configure the requirement in your Auth0 tenant.