# Login\_hint not working when using Auth0 as SAML IDP **URL:** \ **Category:** Get Help\ **Tags:** identifier-first, login-experience\ **Created:** [October 23, 2025, 11:02am UTC](https://community.auth0.com/t/login-hint-not-working-when-using-auth0-as-saml-idp/193531 "2025-10-23T11:02:33Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![leigh.gordon](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/leigh.gordon/32/71521_2.png) [@leigh.gordon](https://community.auth0.com/u/leigh.gordon)\ **Post date:** [October 23, 2025, 11:02am UTC](https://community.auth0.com/t/login-hint-not-working-when-using-auth0-as-saml-idp/193531/1 "2025-10-23T11:02:33Z")
Hi There are several unanswered questions on this from some time ago, so I hope there is a positive update on this in 2025… I have a very standard Application configured, with the SAML IDP enabled in the Addons of this application. I have configured this to using “Identifier First” in the Authentication Profile, and have not modified the . This works well to authenticate SAML service providers for everything _except_ using `login_hint` to pre-populate the email address, meaning in a SP initiated flow, the user is required to enter their email address twice (which is unacceptable from a UX perspective). How can I configure this SAML IDP to correctly retrieve and pre-populate the email address from the login\_hint parameter? > [@Pass login\_hint to Auth0 SAML Identity Provider](https://community.auth0.com/t/pass-login-hint-to-auth0-saml-identity-provider/93156): > > I read @lihua.zhang 's post on passing login\_hint to a SAML IdP [Pass login\_hint to SAML provider](https://community.auth0.com/t/pass-login-hint-to-saml-provider/92546/1) Question - Is there a way to configure Auth0 SAML Identity Provider to recognize login\_hint passed in a SP-initiated flow? Both Okta and AzureAD support this login\_hint. > [@Email prefill not working for SAML application](https://community.auth0.com/t/email-prefill-not-working-for-saml-application/147948/8): > > Or if anyone else can assist… I have a very standard Application with SAML Addon enable to act as a SAML IDP. The login\_hint is definitely being provided to the endpoint defined in the SAML metadata (as provided to the SP), however this is simply being thrown away by the redirection, and email address is not prefilled. https://CUSTOM\_DOMAIN/samlp/ID?SAMLRequest=SAML\_REQUEST&RelayState=RELAY\_STATE&login\_hint=EMAIL\_ADDRESS (HTTP 302) → /u/login/identifier?state=STATE I have searched for hour… ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [October 24, 2025, 4:41pm UTC](https://community.auth0.com/t/login-hint-not-working-when-using-auth0-as-saml-idp/193531/3 "2025-10-24T16:41:32Z")
Hi @leigh.gordon In order to pass a login\_hint to a SAML IdP, you would need to modify the Request Template field for the SAML connection in the Auth0 dashboard. Could you please try adding the `@@LoginHint@@` template variable inside the `saml:Subject` element of the request template.? It should look something like this: ```auto @@LoginHint@@ ``` This is what a full request template should look like and it is confirmed to work when Auth0 is being used as an IdP: ```auto @@Issuer@@ @@LoginHint@@ ``` Let me know if the above worked or if you still have any other questions! Kind Regards, Nik ---
**Author:** ![leigh.gordon](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/leigh.gordon/32/71521_2.png) [@leigh.gordon](https://community.auth0.com/u/leigh.gordon)\ **Post date:** [October 26, 2025, 11:46pm UTC](https://community.auth0.com/t/login-hint-not-working-when-using-auth0-as-saml-idp/193531/5 "2025-10-26T23:46:25Z")
> [@nik.baleca](#): > > ```auto > > @@LoginHint@@ > > > ``` Hi, Sorry if I wasn’t clear. I don’t have an _external_ SAML IDP, I am using Auth0 _as_ the SAML IDP. Configured through Application → Addons → SAML2 WEB APP. This behaves correctly to operate as a SAML identity provider in every way _except_ that when the SP collects the email address on it’s login form, then redirects to the SAML IDP with `login_hint`set as a URL parameter. When Auth0 the redirects to `/u/login/identifier` the `login_hint` is discarded and not prefilled. My service provider is redirecting the client to the Auth0 hosted SAML IDP as follows: [https://custom.example.com/samlp/CLIENTID?login\_hint=mail@example.com](https://custom.example.com/samlp/CLIENTID?login_hint=mail@example.com) It is then redirected (by Auth0) to `/u/login/identifier?state=STATE` The Auth0 login form then presents the user with an empty email address field, which is terrible for user experience… other SaaS based IDPs prefill this automatically, so I’m wondering why Auth0 doesn’t? It’s a very simple but incredibly common and useful behaviour… How can this `login_hint` be propagated to the backend for this prefilling to occur? ---
**Author:** ![leigh.gordon](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/leigh.gordon/32/71521_2.png) [@leigh.gordon](https://community.auth0.com/u/leigh.gordon)\ **Post date:** [October 29, 2025, 3:55am UTC](https://community.auth0.com/t/login-hint-not-working-when-using-auth0-as-saml-idp/193531/6 "2025-10-29T03:55:49Z")
@nik.baleca ok I think after spending some more time on this I can see the issue. I don’t actually want/need Auth0 to act as a SAML SP, which is where I was getting confused. I can prefill the email by modifying the generated SAML Request from a test application without going through all the “Enterprise Connection” procedures (which I found a bit confusing when searching your documentation about _why_ I would need to do that for my use case). The confusion arises because several large IDPs seem to have now removed support for the “Subject” in the SAML Request in favour of the `login_hint` URL parameter. Entra ID and Google for example. Since this has been asked quite a few times over the last few years, I’m assuming Auth0 would not consider implementing the `login_hint` for SAML IDP in the same way as Entra ID/Google? It’s difficult trying to integrate SPs with different IDPs when they all behave slightly differently on the IDP side! > **[Single sign-on SAML protocol - Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/single-sign-on-saml-protocol#subject)** > > This article describes the single sign-on (SSO) SAML protocol in Microsoft Entra ID. > **[SSO sign-in flow when using login hints - Google Workspace Admin Help](https://support.google.com/a/answer/15544042?hl=en)** > > Google as an IdP supports the login hint parameter to simplify sign-in for users when they perform service provider (SP)-initiated sign-ins. When login hints are present, the Google authenticatio ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [November 12, 2025, 8:20pm UTC](https://community.auth0.com/t/login-hint-not-working-when-using-auth0-as-saml-idp/193531/7 "2025-11-12T20:20:26Z")
Hi @leigh.gordon Sorry for replying so late to your last post regarding the topic. Thanks for all the additional information on the matter. Indeed, `login_hint` is now preferred by most IdPs instead of the `Subject` inside the SAML Request, that was an oversight from my part. However, if a SAML connection is not implemented using an Enterprise Connection. In this situation, if the specific IdPs do not support the specific SAML Request configuration, then the login\_hint might not forward as intended unfortunately. I would highly recommend in this situation to submit a [feedback](https://community.auth0.com/c/feedback/95) topic regarding having the SAML Add-on or connection support passing in the login\_hint parameter inside the URL. If I can help with anything else, let me know! Kind Regards, Nik ---
**Author:** ![leigh.gordon](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/leigh.gordon/32/71521_2.png) [@leigh.gordon](https://community.auth0.com/u/leigh.gordon)\ **Post date:** [November 12, 2025, 11:56pm UTC](https://community.auth0.com/t/login-hint-not-working-when-using-auth0-as-saml-idp/193531/8 "2025-11-12T23:56:01Z")
Thanks. In this instance, we were able to have the service provider modified to send `Subject` in the SAMLRequest. It is annoying that it seems to be a “de-facto standard” to support login\_hint for SAML, just because Microsoft and Google choose to do it… would be great if Auth0 could support it, if for no other reason than making it easier for people to migrate _from_ Microsoft/Google _to_ Auth0 without tripping over this issue! In my immediate use case, I have been able to work around it, but I can see the same question has popped up a couple of times from other people too, so would be a useful feature! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [November 26, 2025, 11:56pm UTC](https://community.auth0.com/t/login-hint-not-working-when-using-auth0-as-saml-idp/193531/9 "2025-11-26T23:56:56Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.