How to have one login page for multiple tenant regions?

[mk123]

Use Case:
We have customers who want to store their data in US or Australia regions. We want them to be able to login from the same login page. Also, some customers use SAML/Social/Enterprise connection and we don’t want to show their login buttons on the login page.
We’re not sure that they will always have some fixed domain for their users. So we don’t want to depend on Home Realm Discovery.

Our Current Implementation:

1. We have two tenants, Tenant 1 (US region) and Tenant 2 (Australia region).
2. Our web app does not contain any sub-domains for US and Australia regions. For example, the URL is https://{domain}.com
3. There is our own login page in our web app where user enters their email. It calls our own API which returns the Auth0 tenant and connection information for this user.
4. User is then redirected to Auth0’s Universal login page with pre-added “connection” and “login_hint” params, to open user’s connection automatically (database or SAML/Social/Enterprise connections). This overcomes the limitation of Auth0 that we can’t do Home Realm discovery like automatic connection detection without specifying a domain.

Question

1. Is this the correct way to do this?
2. Can Auth0 provide a single login page for multiple regions. You can take a look at Zoho login page (Zoho Accounts).
   • When you enter a US email, it keeps the domain as https://accounts.zoho.com.
   • When you enter Australia email, it changes the domain to (https://accounts.zoho.com.au)
     So, there is a single login page for multiple regions.

[hadican]

This is a very good question actually. It would be great if someone can answer.

[amin]

Hi,

You current solution can have a side on SSO. Since you’re first going to your own login page and then /authorize endpoint, there is more logic you should add to detect if user had a session or not.

Having said that, what you’re doing today seems correct to me. Auth0 doesn’t have “a single login page for multiple regions” so what you’re doing is reasonable.

I’m sure you have reasons to split customers by region tenant, but if you change your model to single global tenant, and separate regions by connection, then there is no need to have a router page to begin with.

Hope this helps,
Amin

[rueben.tiow]

Thanks for helping on this one @amin!