> For the complete documentation index, see [llms.txt](https://docs.peakcommerce.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.peakcommerce.com/integrations/identity-and-auth/connect-to-openid-connect-identity-provider.md). # Connect to an OpenID Connect Identity Provider ### Prerequisites * [Register your Application with Auth0](https://auth0.com/docs/get-started/auth0-overview/create-applications). * Select an appropriate **Application Type**. * Add an **Allowed Callback URL** of **{**. * Make sure your Application's [Grant Types](https://auth0.com/docs/get-started/applications/update-grant-types) include the appropriate flows. ### Steps To connect your application to an OIDC Identity Provider, you must: 1. [Set up your app in the OpenID Connect Identity Provider](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/oidc#set-up-your-app-in-the-openid-connect-identity-provider) 2. [Create an enterprise connection in Auth0](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/oidc#create-an-enterprise-connection-in-auth0) 3. [Enable the enterprise connection for your Auth0 Application](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/oidc#enable-the-enterprise-connection-for-your-auth0-application) 4. [Test the connection](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/oidc#test-the-connection) *** ### Set up your app in the OpenID Connect Identity Provider To allow users to log in using an OIDC Identity Provider, you must register your application with the IdP. The process of doing this varies depending on the OIDC Identity Provider, so you will need to follow your IdP's documentation to complete this task. Generally, you will want to make sure that at some point you enter your callback URL: https\://{yourDomain}/login/callback. ### Find your Auth0 domain name for redirects If your Auth0 domain name is not shown above and you are not using our [custom domains](https://auth0.com/docs/customize/custom-domains) feature, your domain name is a concatenation of your tenant name, your regional subdomain, and auth0.com, separated by the dot (.) symbol. For example, if your tenant name is exampleco-enterprises, and your tenant is in the US region, your Auth0 domain name would be exampleco-enterprises.us.auth0.com and your **Redirect URI** would be . However, if your tenant is in the US region and was created before June 2020, then your Auth0 domain name would be exampleco-enterprises.auth0.com and your **Redirect URI** would be . If you are using [custom domains](https://auth0.com/docs/customize/custom-domains), your **Redirect URI** would be https\://\/login/callback. During this process, your OIDC Identity Provider will generate a unique identifier for the registered API, usually called a **Client ID** or an **Application ID**. Make note of this value; you will need it later. ### Create an enterprise connection in Auth0 Next, you will need to create and configure a OIDC Enterprise Connection in Auth0. Make sure you have the **Application (client) ID** and the **Client secret** generated when you set up your app in the OIDC provider. #### Create an enterprise connection using the Dashboard To be configurable through the Auth0 Dashboard, the OpenID Connect (OIDC) Identity Provider (IdP) needs to support [OIDC Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html). Otherwise, you can [configure the connection using the Management API](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/oidc#configure-the-connection-using-the-management-api). 1. Navigate to [Auth0 Dashboard > Authentication > Enterprise](https://manage.auth0.com/#/connections/enterprise), locate **Open ID Connect**, and click its +.
2. Enter details for your connection, and select **Create**: | **Connection name** | Logical identifier for your connection; it must be unique for your tenant. Once set, this name can't be changed. | | ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Issuer URL** | URL where Auth0 can find the **OpenID Provider Configuration Document**, which should be available in the /.well-known/openid-configuration endpoint. You can enter the base URL or the full URL. You will see a green checkmark if it can be found at that location, a red mark if it cannot be found, or an error message if the file is found but the required information is not present in the configuration file. | | **Client ID** | Unique identifier for your registered application. Enter the saved value of the **Client ID** for the app you registered with the OIDC Identity Provider. | | **Callback URL** | URL to which Auth0 redirects users after they authenticate. Ensure that this value is configured for the app you registered with the OIDC Identity Provider. | | **Sync user profile attributes at each login** | When enabled, Auth0 automatically syncs user profile data with each user login, thereby ensuring that changes made in the connection source are automatically updated in Auth0. | ### Find your Auth0 domain name for redirects If your Auth0 domain name is not shown above and you are not using our [custom domains](https://auth0.com/docs/customize/custom-domains) feature, your domain name is a concatenation of your tenant name, your regional subdomain, and auth0.com, separated by the dot (.) symbol. For example, if your tenant name is exampleco-enterprises, and your tenant is in the US region, your Auth0 domain name would be exampleco-enterprises.us.auth0.com and your **Redirect URI** would be . However, if your tenant is in the US region and was created before June 2020, then your Auth0 domain name would be exampleco-enterprises.auth0.com and your **Redirect URI** would be . If you are using [custom domains](https://auth0.com/docs/customize/custom-domains), your **Redirect URI** would be https\://\/login/callback.
1. In the **Settings** view, make additional configuration adjustments, if necessary. | **Issuer URL** | Click **Show Issuer Details** to view the Issuer URL **Advanced Settings** and make adjustments. | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Type** | Set to **Front Channel** or **Back Channel**. Front Channel uses the OIDC protocol with response\_mode=form\_post and response\_type=id\_token. Back Channel uses response\_type=code. | | **Scopes** | A comma-separated list of Auth0 scopes to request when connecting to the Identify Provider. This will affect the data stored in the user profile. You are required to include at least the openid scope. Note that the connection does not call /userinfo endpoint and expects the user claims to be present in the id\_token. | 2. In the **Login Experience** view, configure how users log in with this connection. | **Identity Provider domains** | A comma-separated list of the domains that can be authenticated in the Identify Provider. This is only applicable when using [Identifier First](https://auth0.com/docs/authenticate/login/auth0-universal-login/identifier-first) authentication in the Universal Login Experience. | | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Add button** (Optional) | Display a button for this connection in the login page. | | **Button display name** (Optional) | Text used to customize the login button for new Universal Login. When set the button reads: "Continue with {Button display name}". | | **Button logo URL** (Optional) | URL of image used to customize the login button for new Universal Login. When set, the Universal Login login button displays the image as a 20px by 20px square. | Optional fields are available with the New Login Experience only. Customers using the Classic experience will not see the Add button, Button display name, or Button logo URL. 3. Select **Save Changes**. #### Create an enterprise connection using the Management API These examples will show you the variety of ways you can create the \[connection]\(/connections) using Auth0's Management API. You can configure the connection by either providing a metadata URI or by setting the OIDC URLs explicitly. ### Enable the enterprise connection for your Auth0 application To use your new enterprise connection, you must first [enable the connection](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/enable-enterprise-connections) for your Auth0 Applications. ### Test the connection Now you're ready to [test your connection](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/test-enterprise-connections). ### Manually configure Issuer metadata If you click **Show Issuer Details** on the Issuer URL endpoint, you can see the data and adjust it if you need to. ### Federate with Auth0 The OpenID Connect enterprise connection is extremely useful when federating to another Auth0 tenant. Just enter your Auth0 tenant URL (for example, https\://\.us.auth0.com) in the **Issuer** field, and enter the Client ID for any application in the tenant to which you want to federate in the **Client ID** field. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.peakcommerce.com/integrations/identity-and-auth/connect-to-openid-connect-identity-provider.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.