# \#oidc-enterprise-connection **URL:** https://community.auth0.com/tag/oidc-enterprise-connection/1932.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Enterprise Authentication Question for Free Tier](https://community.auth0.com/t/enterprise-authentication-question-for-free-tier/204162)
**Author:** [@jbaker](https://community.auth0.com/u/jbaker)\ **Replies:** 1\ **Last updated:** [October 12, 2026, 10:21pm UTC](https://community.auth0.com/t/enterprise-authentication-question-for-free-tier/204162 "2026-10-12T22:21:38Z")
Per the pricing page the Free Tier supports 1 Enterprise Connection? I have an application that uses a different Identity platform to log in users on my app, but the users then can do Federated SAML2 SSO login to other … --- ## [Changing Enterprise Connection Provider](https://community.auth0.com/t/changing-enterprise-connection-provider/201781)
**Author:** [@peter.cowen](https://community.auth0.com/u/peter.cowen)\ **Replies:** 3\ **Last updated:** [July 21, 2026, 9:35pm UTC](https://community.auth0.com/t/changing-enterprise-connection-provider/201781 "2026-07-21T21:35:15Z")
We have a existing SSO connection setup under ‘Enterprise’ \> OKTA Workforce but are moving over to Azure AD (Entra ID) as the identity provider. The same ‘Email Suffix’ will be used. To move over would I need to delete … --- ## [Migrating from B2C Professional to B2B to enable Enterprise (SAML) Connections](https://community.auth0.com/t/migrating-from-b2c-professional-to-b2b-to-enable-enterprise-saml-connections/199406)
**Author:** [@azratechlead](https://community.auth0.com/u/azratechlead)\ **Replies:** 1\ **Last updated:** [April 28, 2026, 10:50pm UTC](https://community.auth0.com/t/migrating-from-b2c-professional-to-b2b-to-enable-enterprise-saml-connections/199406 "2026-04-28T22:50:04Z")
Hi all, hoping someone from Auth0 or the community can clarify our path forward. Our setup Healthcare SaaS, production tenant on B2C Professional One enterprise customer needs SAML SSO in production Staging works beca… --- ## [What does \`Error saving state.\` mean?](https://community.auth0.com/t/what-does-error-saving-state-mean/199367)
**Author:** [@jsoref](https://community.auth0.com/u/jsoref)\ **Replies:** 1\ **Last updated:** [April 27, 2026, 11:38pm UTC](https://community.auth0.com/t/what-does-error-saving-state-mean/199367 "2026-04-27T23:38:42Z")
We’re seeing Error saving state. messages in our logs: { "date": "2026-04-27T01:03:43.300Z", "type": "f", "description": "Error saving state.", "connection\_id": "", "client\_id": "...", "client\_name": "...",… --- ## [Self-service SSO connection does not return options.domain\_aliases](https://community.auth0.com/t/self-service-sso-connection-does-not-return-options-domain-aliases/197963)
**Author:** [@nathan.johnson](https://community.auth0.com/u/nathan.johnson)\ **Replies:** 6\ **Last updated:** [March 9, 2026, 5:23pm UTC](https://community.auth0.com/t/self-service-sso-connection-does-not-return-options-domain-aliases/197963 "2026-03-09T17:23:54Z")
Hi I am struggling with getting access to the domain aliases for a given self-service SSO connection. I’m configuring using an Okta Workforce connection an I am following the docs here: ..which states that ‘Both meth… --- ## [Azure AD domain user with external email address](https://community.auth0.com/t/azure-ad-domain-user-with-external-email-address/195156)
**Author:** [@peter.cowen](https://community.auth0.com/u/peter.cowen)\ **Replies:** 1\ **Last updated:** [December 4, 2025, 1:52am UTC](https://community.auth0.com/t/azure-ad-domain-user-with-external-email-address/195156 "2025-12-04T01:52:57Z")
We have recently come across a customer that has a domain user that is setup with the email address field containing a external email (not linked to their domain) They have a Enterprise connection Azure AD setup with us… --- ## [Access AMR from enterprise connection in login flow](https://community.auth0.com/t/access-amr-from-enterprise-connection-in-login-flow/195019)
**Author:** [@eff](https://community.auth0.com/u/eff)\ **Replies:** 4\ **Last updated:** [December 2, 2025, 6:28pm UTC](https://community.auth0.com/t/access-amr-from-enterprise-connection-in-login-flow/195019 "2025-12-02T18:28:06Z")
I’m using enterprise connection where the IdP has several different auth mechanisms, and I want to know which mechanism was used. This information resides in the AMR tag in the response from the external IdP, but I can’t… --- ## [Enterprise Connection retrieve access token](https://community.auth0.com/t/enterprise-connection-retrieve-access-token/194890)
**Author:** [@stuart.mackintosh](https://community.auth0.com/u/stuart.mackintosh)\ **Replies:** 2\ **Last updated:** [November 26, 2025, 9:36am UTC](https://community.auth0.com/t/enterprise-connection-retrieve-access-token/194890 "2025-11-26T09:36:47Z")
Hello, I am trying to follow Call an Identity Provider API to get an access token once the user has authenticated from an Enterprise Connection. When I then try to exchange this using the API described: GET https://de… --- ## [Internal Error on First Login Only When Using Company Tenant (Works on Personal Tenant)](https://community.auth0.com/t/internal-error-on-first-login-only-when-using-company-tenant-works-on-personal-tenant/194646)
**Author:** [@biswajyotisaha](https://community.auth0.com/u/biswajyotisaha)\ **Replies:** 2\ **Last updated:** [November 19, 2025, 7:04pm UTC](https://community.auth0.com/t/internal-error-on-first-login-only-when-using-company-tenant-works-on-personal-tenant/194646 "2025-11-19T19:04:12Z")
Hi everyone, I’m using Auth0 as the authentication provider for an application built with the ChatGPT Apps SDK, and I’m running into an issue that only occurs when using my company’s Auth0 tenant. The exact same setup w… --- ## [Enterprise connection scope delimiter](https://community.auth0.com/t/enterprise-connection-scope-delimiter/193897)
**Author:** [@stuart.mackintosh](https://community.auth0.com/u/stuart.mackintosh)\ **Replies:** 2\ **Last updated:** [November 11, 2025, 7:43pm UTC](https://community.auth0.com/t/enterprise-connection-scope-delimiter/193897 "2025-11-11T19:43:31Z")
My OIDC provider connected via an Enterprise Connection requires scopes to be delimited by spaces, however when I set the scope in the connection as openid and connection\_scope in NextJS to custom\_scope the auth fails wi… --- ## [Unable to get successful login after creating Enterprise OIDC connection](https://community.auth0.com/t/unable-to-get-successful-login-after-creating-enterprise-oidc-connection/193512)
**Author:** [@megha.shinde](https://community.auth0.com/u/megha.shinde)\ **Replies:** 2\ **Last updated:** [October 30, 2025, 10:43am UTC](https://community.auth0.com/t/unable-to-get-successful-login-after-creating-enterprise-oidc-connection/193512 "2025-10-30T10:43:11Z")
R{ “error”: “invalid\_request”, “error\_description”: “server responded with an error in the response body” }eady to post? :magnifying\_glass\_tilted\_right: First try searching for your answer. --- ## [Okta profile firstName and lastName do not sync to Raw JSON of Okta-managed Auth0 users](https://community.auth0.com/t/okta-profile-firstname-and-lastname-do-not-sync-to-raw-json-of-okta-managed-auth0-users/192482)
**Author:** [@kpaynter](https://community.auth0.com/u/kpaynter)\ **Replies:** 4\ **Last updated:** [November 28, 2025, 7:54pm UTC](https://community.auth0.com/t/okta-profile-firstname-and-lastname-do-not-sync-to-raw-json-of-okta-managed-auth0-users/192482 "2025-11-28T19:54:01Z")
In Auth0, my Okta Integration is set to sync user profiles “On each Login”. In Okta the Auth0 Integration app has the following User Profile Mappings: user.firstName→given\_name user.lastName→family\_name I assume tha… --- ## [Issue with Role Assignment and Token Permissions on First Login via OIDC Federated Connection (Cross-Tenant Setup)](https://community.auth0.com/t/issue-with-role-assignment-and-token-permissions-on-first-login-via-oidc-federated-connection-cross-tenant-setup/189640)
**Author:** [@preethamgowda](https://community.auth0.com/u/preethamgowda)\ **Replies:** 1\ **Last updated:** [July 31, 2025, 7:03pm UTC](https://community.auth0.com/t/issue-with-role-assignment-and-token-permissions-on-first-login-via-oidc-federated-connection-cross-tenant-setup/189640 "2025-07-31T19:03:16Z")
Setup Overview App 1 : Hosted in Auth0 Tenant A . This is the app users directly log into. App 2 : Hosted in a different Auth0 Tenant B . App 2 will be integrated somehow with App 1. Federation: We have configur… --- ## [No 3rd party refresh\_token available with AzureAd connection](https://community.auth0.com/t/no-3rd-party-refresh-token-available-with-azuread-connection/188151)
**Author:** [@phil.cole](https://community.auth0.com/u/phil.cole)\ **Replies:** 2\ **Last updated:** [June 30, 2025, 9:26pm UTC](https://community.auth0.com/t/no-3rd-party-refresh-token-available-with-azuread-connection/188151 "2025-06-30T21:26:11Z")
We are looking at allowing customers to access their Microsoft calendar from our .NET application using an initial login to Azure AD via an Auth0 enterprise connection. We have created a POC where the user authenticates… --- ## [In some cases Self-Serve OIDC Communication Channel displays incorrectly](https://community.auth0.com/t/in-some-cases-self-serve-oidc-communication-channel-displays-incorrectly/186152)
**Author:** [@neal.ferrazzani](https://community.auth0.com/u/neal.ferrazzani)\ **Replies:** 5\ **Last updated:** [May 15, 2025, 8:34pm UTC](https://community.auth0.com/t/in-some-cases-self-serve-oidc-communication-channel-displays-incorrectly/186152 "2025-05-15T20:34:31Z")
For some reason I am sometimes seeing incorrect behavior in the Enterprise Connection Self-serve flow, specifically when managing Custom OIDC connections. I am seeing different behavior between two customers’ Custom OIDC… --- ## [Signed Requests for Enterprise OIDC connection](https://community.auth0.com/t/signed-requests-for-enterprise-oidc-connection/186598)
**Author:** [@elster](https://community.auth0.com/u/elster)\ **Replies:** 1\ **Last updated:** [May 12, 2025, 6:21pm UTC](https://community.auth0.com/t/signed-requests-for-enterprise-oidc-connection/186598 "2025-05-12T18:21:54Z")
We want to establish a federation from Auth0 to Criipto using an Enterprise OIDC connection. The IdP requires signed requests for the authorization endpoint call as defined in the OIDC spec. Is there a way to configure t… --- ## [Self-Service SSO ticket](https://community.auth0.com/t/self-service-sso-ticket/186387)
**Author:** [@AnatoliiP85](https://community.auth0.com/u/AnatoliiP85)\ **Replies:** 3\ **Last updated:** [May 7, 2025, 8:41pm UTC](https://community.auth0.com/t/self-service-sso-ticket/186387 "2025-05-07T20:41:38Z")
Is this expected behavior that when placing two different self-service SSO tickets into the same browser tab to create a connection, the identity provider from the first ticket is automatically selected for the second on… --- ## [How do I configure an OIDC Enterprise Connection to use Authorization Code flow with PKCE?](https://community.auth0.com/t/how-do-i-configure-an-oidc-enterprise-connection-to-use-authorization-code-flow-with-pkce/186171)
**Author:** [@neal.ferrazzani](https://community.auth0.com/u/neal.ferrazzani)\ **Replies:** 10\ **Last updated:** [May 6, 2025, 5:18pm UTC](https://community.auth0.com/t/how-do-i-configure-an-oidc-enterprise-connection-to-use-authorization-code-flow-with-pkce/186171 "2025-05-06T17:18:06Z")
Continuing the discussion from OIDC enterprise connection to Azure AD using authorisation code flow with pkce: Hi Dan, it looks like this feature was being actively worked on back in 2023. Is it available now? If so, w… --- ## [OpenID Connect User Mapping: how to map a url-namespaced custom claim](https://community.auth0.com/t/openid-connect-user-mapping-how-to-map-a-url-namespaced-custom-claim/149500)
**Author:** [@enigma3319](https://community.auth0.com/u/enigma3319)\ **Replies:** 2\ **Last updated:** [May 2, 2025, 4:14pm UTC](https://community.auth0.com/t/openid-connect-user-mapping-how-to-map-a-url-namespaced-custom-claim/149500 "2025-05-02T16:14:36Z")
Hello. I’m working with an Open ID Enterprise connection, and trying to figure out how to map a url-namespaced custom claim. I read through the docs Configure PKCE and Claim Mapping for OIDC Connections but they don’t … --- ## [Add custom SCIM attribute in Inbound SCIM connection](https://community.auth0.com/t/add-custom-scim-attribute-in-inbound-scim-connection/184000)
**Author:** [@lucho](https://community.auth0.com/u/lucho)\ **Replies:** 2\ **Last updated:** [March 18, 2025, 1:51pm UTC](https://community.auth0.com/t/add-custom-scim-attribute-in-inbound-scim-connection/184000 "2025-03-18T13:51:29Z")
I’m trying to set up Inbound SCIM provisioning using Okta following Configure Inbound SCIM. However, when I try to use an attribute that is not part of the Core SCIM RFC RFC 7643 sections 3.1, 4.1, and 4.3, the mapping d… --- ## [Configure OIDC connection for Single-Page-Application](https://community.auth0.com/t/configure-oidc-connection-for-single-page-application/147327)
**Author:** [@jkintner](https://community.auth0.com/u/jkintner)\ **Replies:** 1\ **Last updated:** [March 12, 2025, 8:50pm UTC](https://community.auth0.com/t/configure-oidc-connection-for-single-page-application/147327 "2025-03-12T20:50:06Z")
I added an OIDC connection for an SPA (react). The configuration was given to me by the institution we’re setting the connection up for. When using the OIDC connection to login, I receive this error: Failed Login: inva… --- ## [Okta Workforce Entreprise SSO Groups Clarification](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455)
**Author:** [@davidhouseknechtdev](https://community.auth0.com/u/davidhouseknechtdev)\ **Replies:** 12\ **Last updated:** [March 11, 2025, 8:30pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455 "2025-03-11T20:30:01Z")
Question Following up on Okta Workforce Entreprise SSO Groups – is this still the case? Reasoning I ask because I setup an Okta Workforce connection and I select the User Mapping \> Okta Default setting I see that groups … --- ## [How to Achieve Seamless SSO with OIDC Enterprise Connection?](https://community.auth0.com/t/how-to-achieve-seamless-sso-with-oidc-enterprise-connection/182268)
**Author:** [@yuriscom](https://community.auth0.com/u/yuriscom)\ **Replies:** 5\ **Last updated:** [February 21, 2025, 1:09am UTC](https://community.auth0.com/t/how-to-achieve-seamless-sso-with-oidc-enterprise-connection/182268 "2025-02-21T01:09:25Z")
Hi Community! I followed the Auth0 documentation for setting up an OIDC Enterprise Connection. My goal is to achieve completely seamless SSO when a user logs into App1 (via IDP1) and then navigates to App2 (via IDP2, w… --- ## [Default connection when using universal login](https://community.auth0.com/t/default-connection-when-using-universal-login/147587)
**Author:** [@nirajan.kharal](https://community.auth0.com/u/nirajan.kharal)\ **Replies:** 4\ **Last updated:** [January 29, 2025, 11:43pm UTC](https://community.auth0.com/t/default-connection-when-using-universal-login/147587 "2025-01-29T23:43:56Z")
We are using universal login. My case scenario is if user domain is not in listed in the connection, I want to send them all to a default connection. I do not want to use the db connection. New to auth0 so any help on th… --- ## [Okta Workforce Enterprise Connection for SPA](https://community.auth0.com/t/okta-workforce-enterprise-connection-for-spa/157619)
**Author:** [@loris32](https://community.auth0.com/u/loris32)\ **Replies:** 1\ **Last updated:** [December 7, 2024, 1:17am UTC](https://community.auth0.com/t/okta-workforce-enterprise-connection-for-spa/157619 "2024-12-07T01:17:53Z")
I tried to follow the documentation page to setup an enterprise connection for a SPA, but when I went through Select Web application as the Application type since there is a “SPA” application type selectable, I susp… --- ## [Okta Workforce IdP in Auth0 for SPA](https://community.auth0.com/t/okta-workforce-idp-in-auth0-for-spa/131913)
**Author:** [@ricky2](https://community.auth0.com/u/ricky2)\ **Replies:** 3\ **Last updated:** [December 7, 2024, 1:25am UTC](https://community.auth0.com/t/okta-workforce-idp-in-auth0-for-spa/131913 "2024-12-07T01:25:44Z")
Hi, I am currently using Auth0 for user authentication in my React application. I am looking to integrate Okta Workforce within Auth0 as an Enterprise connection. However, in the connection page it is asking for a client… --- ## ["error\_description": "The resource owner or authorization server denied the request." when testing Okta/Auth0 connection](https://community.auth0.com/t/error-description-the-resource-owner-or-authorization-server-denied-the-request-when-testing-okta-auth0-connection/113309)
**Author:** [@terekhina.maria](https://community.auth0.com/u/terekhina.maria)\ **Replies:** 1\ **Last updated:** [November 25, 2024, 10:20pm UTC](https://community.auth0.com/t/error-description-the-resource-owner-or-authorization-server-denied-the-request-when-testing-okta-auth0-connection/113309 "2024-11-25T22:20:18Z")
Hello, I’ve been following the guide Connect Your Auth0 Application with Okta Enterprise Connection and was able to get to this error. my okta account is a dev account, and my auth0 account is not paid account (since I … --- ## [Any way to assign RBAC roles based on SCIM info?](https://community.auth0.com/t/any-way-to-assign-rbac-roles-based-on-scim-info/152002)
**Author:** [@timtylin](https://community.auth0.com/u/timtylin)\ **Replies:** 1\ **Last updated:** [November 22, 2024, 10:01am UTC](https://community.auth0.com/t/any-way-to-assign-rbac-roles-based-on-scim-info/152002 "2024-11-22T10:01:46Z")
Hey there, I’ve been looking for a way to automatically assign some users certain roles (I’m referring to native Auth0 RBAC “core” roles, not the Auth Extension ones that live in app\_metadata) based on their Okta Group m… --- ## [User Registration during SS0 Login](https://community.auth0.com/t/user-registration-during-ss0-login/134113)
**Author:** [@joe.abraham](https://community.auth0.com/u/joe.abraham)\ **Replies:** 4\ **Last updated:** [May 17, 2024, 7:25am UTC](https://community.auth0.com/t/user-registration-during-ss0-login/134113 "2024-05-17T07:25:40Z")
I’m trying to login with a user which is not present in Auth0 via SSO. This creates a new user in Auth0. How to prevent this user registration and need to throw error if the user does not exists in Auth0 --- ## [Custom scopes/permissions not included in access token from Okta IdP](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617)
**Author:** [@darrenk](https://community.auth0.com/u/darrenk)\ **Replies:** 4\ **Last updated:** [May 7, 2024, 9:48pm UTC](https://community.auth0.com/t/custom-scopes-permissions-not-included-in-access-token-from-okta-idp/133617 "2024-05-07T21:48:29Z")
Hi, In Auth0 I have configured: A Custom API with 18 permissions. A Next.js client that calls the API. A SPA Auth0 application with an “enterprise connection” to an Okta OIDC IdP. An enterprise connection to an Okta O… [Next page](https://community.auth0.com/tag/oidc-enterprise-connection/1932.md?match_all_tags=true&page=1&tags%5B%5D=oidc-enterprise-connection)