Set up Auth0 SSO

This guide connects an Auth0 application to your Tightknit community. Use OIDC unless your organization specifically requires SAML.

Prerequisites

A Tightknit Enterprise community with SSO enabled
Permission to manage Site > Authentication in Tightknit Studio
Permission to create applications in your Auth0 tenant
An existing Tightknit member account for testing

Create the provider disabled and enable it immediately before a controlled test. You can correct an enabled provider in place; Studio asks you to confirm because changes apply to member sign-ins immediately. See Editing a live provider.

Configure Auth0 with OIDC

Start the provider in Tightknit

Open Site > Authentication, select Add provider, and choose OIDC.Keep the suggested provider ID or enter another globally unique ID. You cannot change it after creating the provider.

Create the Auth0 application

In the Auth0 Dashboard, go to Applications > Applications, select Create Application, and choose Regular Web Applications.

Add the callback URL

In Tightknit, continue to Connect and copy the callback URL. In Auth0, paste it into Allowed Callback URLs, then save the application settings.

Copy the OIDC values

In Auth0, copy the Domain, Client ID, and Client Secret. If your Auth0 domain is example.us.auth0.com, enter these values in Tightknit:Tightknit requires the JWKS endpoint so it can validate signed ID tokens without performing discovery during a member’s sign-in.

Tightknit field	Auth0 value
Issuer URL	`https://example.us.auth0.com/`
Client ID	Auth0 Client ID
Client secret	Auth0 Client Secret
Authorization endpoint	`https://example.us.auth0.com/authorize`
Token endpoint	`https://example.us.auth0.com/oauth/token`
Discovery endpoint	`https://example.us.auth0.com/.well-known/openid-configuration`
JWKS endpoint	`https://example.us.auth0.com/.well-known/jwks.json`
UserInfo endpoint	`https://example.us.auth0.com/userinfo`
Scopes	`openid profile email`

Create and test the provider

Create the provider while Enabled is off. Open your community sign-in page in a private browser window, enable the provider, and sign in with the test member.Review Settings > Audit under Authentication after the test. If it failed, edit the provider and confirm Save live changes, or disable it first if you would rather members not see it while you investigate.

Configure Auth0 with SAML

Start the provider in Tightknit

Open Site > Authentication, select Add provider, and choose SAML 2.0.

Create the Auth0 application

In the Auth0 Dashboard, create a Regular Web Application. Open its Addons tab and enable SAML2 Web App.

Configure the Auth0 SAML addon

In Tightknit, continue to Connect. Copy the ACS URL into Auth0’s Application Callback URL and copy the Entity ID into the SAML audience setting.Open the addon’s Settings tab and use this configuration, replacing the example values with the ACS URL and Entity ID from Tightknit:

{
  "audience": "https://api.tightknit.ai/api/auth/sso/saml2/sp/metadata",
  "recipient": "https://api.tightknit.ai/auth/sso/saml2/callback/relevance-ai-saml",
  "destination": "https://api.tightknit.ai/auth/sso/saml2/callback/relevance-ai-saml",
  "mappings": {
    "email": "email",
    "name": "name"
  },
  "nameIdentifierProbes": ["email"],
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
}

Select Debug, verify the assertion contains the member’s email as email and as NameID, then select Save.

Copy the Auth0 metadata

Open the SAML2 Web App addon’s Usage tab and download the identity provider metadata. In Tightknit, choose IdP metadata XML and paste the complete XML document.Copy the metadata root element’s entityID value into Tightknit’s required IdP issuer field.You can instead choose Sign-on URL and certificate and copy those values from Auth0, but do not use both configuration methods.

Create and test the provider

Create the provider while it is disabled. Enable it for a controlled test with an existing community member, then review the Authentication audit log. A failed configuration can be corrected while the provider stays enabled; when you edit the certificate, paste it with real line breaks or leave the field blank to keep the stored one.

Custom token (JWT)

Auth0 can also issue custom JWTs for an IdP-initiated integration, such as a link inside your own product that signs members straight in to your community. In Tightknit, choose Custom token (JWT) and enter your issuer, audience, signing algorithm, and Auth0’s public JWKS URL (https://example.us.auth0.com/.well-known/jwks.json). See Set up a custom token (JWT) provider. Never share signing secrets.

Troubleshooting

Auth0 reports an invalid callback URL

Copy the callback or ACS URL from Tightknit again and replace the Auth0 value. The URLs must match exactly.

OIDC reports an invalid client

Confirm you copied the Client ID and Client Secret from the same Auth0 application. If you rotated the secret, edit the Tightknit provider and enter the new value.

SAML does not return an email address

Update the Auth0 SAML mapping so the assertion includes the member email as email or NameID. Tightknit cannot match a member without an email address.

Auth0 enables each connection per application, so a connection that appears on another application’s login page can be missing from the one Tightknit uses. In the Auth0 Dashboard, open the connection, go to its Applications tab, and turn on the application you created for Tightknit.For an enterprise connection, also confirm Display connection as a button is checked on the connection’s Login Experience tab. Without it, Universal Login shows no button for the connection.

Microsoft shows an error after the member chooses SSO

When Auth0 federates to your organization’s Microsoft Entra ID, Entra can reject the member before Auth0 or Tightknit sees the sign-in. See The identity provider blocks the member before they reach Tightknit.

Tightknit denies access after Auth0 succeeds

Confirm the Auth0 email exactly matches an active member in your Tightknit community. SSO authentication does not provision new community members.

Overview

Slack Setup

Tightknit Setup

External Tools

Prerequisites

Configure Auth0 with OIDC

Configure Auth0 with SAML

Custom token (JWT)

Troubleshooting

​Prerequisites

​Configure Auth0 with OIDC

​Configure Auth0 with SAML

​Custom token (JWT)

​Troubleshooting

Prerequisites

Configure Auth0 with OIDC

Configure Auth0 with SAML

Custom token (JWT)

Troubleshooting