Description:
I’m experiencing an SSO issue where users who are already authenticated in our Auth0 application are being prompted to sign in again through Auth0 (not a third-party login) when accessing a federated third-party service. Here’s our setup:
Current Setup:
- SPA + API architecture using Auth0
- Auth0 tenant federated with a third-party authorization server
- We act as the Identity Provider with our Auth0 tenant
- OAuth/OIDC flow configured with the third-party service
Expected Behavior: Users authenticated in our Auth0 application should seamlessly access the third-party service without any additional authentication prompts.
Actual Behavior:
- Users successfully sign into our Auth0 application
- When clicking the third-party integration button for the first time in the session, users are redirected to Auth0 login page (our tenant, not third-party)
- Users are required to authenticate again through Auth0
- After this re-authentication, the integration works perfectly for the remainder of the session
- This suggests the SSO session gets established correctly after the initial re-authentication
Key Details:
- Users are being prompted to authenticate through our Auth0 tenant (correct IdP), not the third-party service
- The issue occurs on first access to third-party service within a session
- Once re-authenticated, SSO works seamlessly
- We haven’t implemented state parameter handling yet
Questions:
- Why isn’t the existing Auth0 session being recognized when initiating the federated flow?
- Are there specific SSO session settings in Auth0 that need to be configured for federated scenarios?
- Could this be related to session timeout settings or Universal Login implementation?
- Is there a difference between application session and Auth0 Authorization Server session that could cause this?
Any guidance on troubleshooting Auth0 SSO session recognition issues would be greatly appreciated.
Environment:
- Auth0 SPA + API
- Auth0 tenant acting as IdP
- Third-party OAuth/OIDC authorization server