SSO SAML Multi-Tenant Auth0 Organization Context on Universal Login

Get Help
, ,
1

Hi,

I have a question about configuring SAML SSO in Auth0 for a multi-tenant SaaS application.

Setup:

  • Each client has one organization in Auth0
  • Each organization has multiple tenant organizations under it
  • We use Auth0 Universal Login

What we need:
When a user logs in via SAML (SAML2 connection configured per client), Auth0 should know which organization that user belongs to, so they are automatically added as a member of the correct Auth0 organization on their first SSO login.

The problem:
Auth0 requires an organization parameter in the login context to associate the user with the right organization. But since we use Universal Login, we are not sure:

  1. How do we pass the organization context when a SAML login is initiated — especially since the login is triggered from the IdP side (IdP-initiated) or the user just hits the universal login URL without an org context?
  2. How does Auth0 determine which organization a SAML connection belongs to when multiple clients each have their own SAML connection configured?
  3. Is there a way to map a SAML connection to an Auth0 organization automatically, so that when a user authenticates via that connection, Auth0 knows which organization to add them to without us explicitly passing the organization parameter?