Setting up multi-tenant OIDC connections — how do you manage per-tenant configurations?

[code-vj]

Hi everyone

I’m currently building a B2B SaaS app where each tenant can connect their own IdP (Okta, Entra ID, Google Workspace, etc.) using OIDC.

Auth0 handles this pretty well with “enterprise connections”, but I’ve been researching how to achieve similar flexibility using custom OIDC layers.

For instance, SSOJet provides a way to dynamically load tenant configurations from a database and handle both SP- and IdP-initiated flows.

Curious — how are others managing multi-tenant OIDC configuration in Auth0? Any best practices or pitfalls?

Thanks in advance

[remus.ivan]

Hello @code-vj,

Welcome to the Auth0 Community!

I am looking into your use case, so please allow me some time to provide a more detailed response to your inquiry.

Thank you!
Best regards,
Remus

[remus.ivan]

Hello @code-vj,

Welcome to the Auth0 Community!

The primary and best-practice solution for this your B2B SaaS scenario is Auth0 Organizations, being the specific built feature to solve the multi-tenant problem and providing the dynamic configuration you’re looking for natively. This approach allows to securely and dynamically connect to any OIDC-compliant Identity Provider your company uses, whether it’s Okta, Entra ID, Google Workspace, or another. Check Enable Organization Connections.

You can create an Organization for each customer, then attach one or more Enterprise Connections to that specific organization. This is all manageable via the Auth0 Management API for automatization by endpoints such as:

• Creating an Organization using the POST /v2/organizations endpoint

• Add connections to an organization using the POST /v2/organizations/{id}/enabled_connections endpoint

The SP-Initiated Flow is handled perfectly within the Identifier First Authentication, which allows prompting the user both for their credentials or their organization first, so I would recommend checking our documentation.

This is the modern, standard way of achieving your desired architecture, since creating separate connections per tenant would be very difficult when thinking of scalability.

I hope this helps, and if you have further inquiries please let me know!
Thank you!
Best regards,
Remus