Pass the login_hint Parameter to a SAML Identity Provider in Auth0

Last Updated: Jul 14, 2026

Overview

In a Single Sign-On (SSO) environment, Security Assertion Markup Language (SAML) Enterprise Connections do not pass the login_hint parameter by default. Modifying the Request Template field for the SAML connection in the Auth0 Dashboard allows administrators to pass this parameter to a SAML Identity Provider (IdP).

Applies To

Auth0
login_hint
New Universal Login
Identifier First
SAML Enterprise Connections

Solution

How is the login_hint parameter passed to a SAML Identity Provider?

To pass a login_hint to a SAML IdP, modify the Request Template field for the SAML connection in the Auth0 Dashboard. Add the @@LoginHint@@ template variable inside the <saml:Subject> element of the request template.

NOTE: A prerequisite is that the configuration is confirmed to work only with the New Universal Login experience when the Authentication Profile is set to Identifier First.

Review the following example snippet of the modified request template.

<saml:Subject xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
   <NameID>@@LoginHint@@</NameID>
   <NameIdentifier>@@LoginHint@@</NameIdentifier>
</saml:Subject>

The following is a full request template provided for reference. It is confirmed to work when Auth0 is the IdP.

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
@@AssertServiceURLAndDestination@@
    ID="@@ID@@"                             
    IssueInstant="@@IssueInstant@@"
    AppName="@@ProviderName@@" 
    ProtocolBinding="@@ProtocolBinding@@" Version="2.0">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@@Issuer@@</saml:Issuer>
    <saml:Subject xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        <NameID>@@LoginHint@@</NameID>
        <NameIdentifier>@@LoginHint@@</NameIdentifier>
    </saml:Subject>
</samlp:AuthnRequest>

Related References

Identifier First