Handle Identity Provider (IdP) initiated flows when using an Auth0 Enterprise OpenID Connect (OIDC) connection by configuring the IdP to redirect to the application login initiation endpoint or by switching to a Security Assertion Markup Language (SAML) connection. An application requires a seamless login experience when launched directly from a third-party IdP portal, but the current OIDC implementation prevents a direct IdP-initiated login because the OIDC protocol does not support this flow.

• Auth0
• Enterprise Connections
• OpenID Connect (OIDC)
• Identity Provider (IdP) Initiated Flows

Auth0 does not accept IdP-initiated OIDC responses because the OIDC protocol does not support this flow.

How does Auth0 handle IdP-initiated flows with OIDC connections?

Implement one of the following methods to achieve a seamless login experience from an external IdP dashboard.

• If the third-party IdP supports custom dashboard links, configure the IdP dashboard to send the user directly to the application login initiation endpoint. The application then sends an authentication request to Auth0 that includes the specific connection parameter (for example, https://<application-url>/login?connection=<connection-name>).
• If the IdP cannot redirect to the application login endpoint, use a SAML connection instead of OIDC. Configure the IdP-initiated settings within the Auth0 SAML connection to send the user to the application login initiation endpoint.

For both methods, the application must implement a login initiation endpoint that receives a connection parameter and passes it along in the /authorize request.

Related References

• Configure IdP-Initiated SAML Sign-On to OIDC Apps