Set up Auth0 SSO

This guide connects an Auth0 application to your Tightknit community. Use OIDC unless your organization specifically requires SAML.

Prerequisites

A Tightknit Enterprise community with SSO enabled
Permission to manage Site > Authentication in Tightknit Studio
Permission to create applications in your Auth0 tenant
An existing Tightknit member account for testing

Create the provider disabled. Enable it immediately before a controlled test, and disable it again before correcting any errors.

Configure Auth0 with OIDC

Start the provider in Tightknit

Open Site > Authentication, select Add provider, and choose OIDC.Keep the suggested provider ID or enter another globally unique ID. You cannot change it after creating the provider.

Create the Auth0 application

In the Auth0 Dashboard, go to Applications > Applications, select Create Application, and choose Regular Web Applications.

Add the callback URL

In Tightknit, continue to Connect and copy the callback URL. In Auth0, paste it into Allowed Callback URLs, then save the application settings.

Copy the OIDC values

In Auth0, copy the Domain, Client ID, and Client Secret. If your Auth0 domain is example.us.auth0.com, enter these values in Tightknit:Tightknit requires the JWKS endpoint so it can validate signed ID tokens without performing discovery during a member’s sign-in.

Tightknit field	Auth0 value
Issuer URL	`https://example.us.auth0.com/`
Client ID	Auth0 Client ID
Client secret	Auth0 Client Secret
Authorization endpoint	`https://example.us.auth0.com/authorize`
Token endpoint	`https://example.us.auth0.com/oauth/token`
Discovery endpoint	`https://example.us.auth0.com/.well-known/openid-configuration`
JWKS endpoint	`https://example.us.auth0.com/.well-known/jwks.json`
UserInfo endpoint	`https://example.us.auth0.com/userinfo`
Scopes	`openid profile email`

Create and test the provider

Create the provider while Enabled is off. Open your community sign-in page in a private browser window, enable the provider, and sign in with the test member.Review Settings > Audit under Authentication after the test. Disable the provider again before correcting any errors.

Configure Auth0 with SAML

Start the provider in Tightknit

Open Site > Authentication, select Add provider, and choose SAML 2.0.

Create the Auth0 application

In the Auth0 Dashboard, create a Regular Web Application. Open its Addons tab and enable SAML2 Web App.

Configure the Auth0 SAML addon

In Tightknit, continue to Connect. Copy the ACS URL into Auth0’s Application Callback URL and copy the Entity ID into the SAML audience setting.Open the addon’s Settings tab and use this configuration, replacing the example values with the ACS URL and Entity ID from Tightknit:

{
  "audience": "https://api.tightknit.ai/api/auth/sso/saml2/sp/metadata",
  "recipient": "https://api.tightknit.ai/auth/sso/saml2/callback/relevance-ai-saml",
  "destination": "https://api.tightknit.ai/auth/sso/saml2/callback/relevance-ai-saml",
  "mappings": {
    "email": "email",
    "name": "name"
  },
  "nameIdentifierProbes": ["email"],
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
}

Select Debug, verify the assertion contains the member’s email as email and as NameID, then select Save.

Copy the Auth0 metadata

Open the SAML2 Web App addon’s Usage tab and download the identity provider metadata. In Tightknit, choose IdP metadata XML and paste the complete XML document.Copy the metadata root element’s entityID value into Tightknit’s required IdP issuer field.You can instead choose Sign-on URL and certificate and copy those values from Auth0, but do not use both configuration methods.

Create and test the provider

Create the provider while it is disabled. Enable it for a controlled test with an existing community member, then review the Authentication audit log. Disable it before changing a failed configuration.

Custom token (JWT)

Auth0 can also issue custom JWTs for an IdP-initiated integration, but this flow requires coordinated setup. In Tightknit, choose Custom token (JWT) and contact the Tightknit team with your issuer, public JWKS URL, audience, signing algorithm, and Auth0 login URL. Do not send signing secrets.

Troubleshooting

Auth0 reports an invalid callback URL

Copy the callback or ACS URL from Tightknit again and replace the Auth0 value. The URLs must match exactly.

OIDC reports an invalid client

Confirm you copied the Client ID and Client Secret from the same Auth0 application. If you rotated the secret, edit the Tightknit provider and enter the new value.

SAML does not return an email address

Update the Auth0 SAML mapping so the assertion includes the member email as email or NameID. Tightknit cannot match a member without an email address.

Tightknit denies access after Auth0 succeeds

Confirm the Auth0 email exactly matches an active member in your Tightknit community. SSO authentication does not provision new community members.

Overview

Slack Setup

Tightknit Setup

External Tools

Prerequisites

Configure Auth0 with OIDC

Configure Auth0 with SAML

Custom token (JWT)

Troubleshooting

​Prerequisites

​Configure Auth0 with OIDC

​Configure Auth0 with SAML

​Custom token (JWT)

​Troubleshooting

Prerequisites

Configure Auth0 with OIDC

Configure Auth0 with SAML

Custom token (JWT)

Troubleshooting