SSO using OIDC

​

Prerequisites

• An Auth0 account with admin access to create applications
• Bifrost Enterprise deployed and accessible
• Your Bifrost callback URL: https://<your-bifrost-domain>/login
• Bifrost roles created for the roles you plan to map

​

Step 1: Create a regular web application

1

Open the Auth0 dashboard

Sign in to manage.auth0.com.In the left navigation, go to Applications → Applications and click Create Application.

2

Choose the application type

Give the app a name - e.g. Bifrost OIDC.Select Regular Web Application and click Create.

3

Open the Settings tab

After creating the app, go to the Settings tab. You will see your app’s Domain, Client ID, and Client Secret at the top - keep this tab open as you will need these values later.

4

Configure callback URLs

Still on the Settings tab, scroll down to Application URIs and add your login callback to Allowed Callback URLs:

https://<your-bifrost-domain>/login

Optionally, to use the Discover Claims feature during Bifrost setup, also add:

https://<your-bifrost-domain>/workspace/scim/oauth-discover-callback

Discover Claims opens a one-time sign-in popup during configuration so Bifrost can inspect the exact JWT your Auth0 tenant sends - useful for verifying the roles claim is present before you build your attribute mappings. You can skip it and add the URL later if needed.

Scroll down and click Save Changes.

5

Copy your credentials

Scroll back up to the top of the Settings tab and copy:

• Domain - e.g. your-tenant.us.auth0.com
• Client ID
• Client Secret (click to reveal)

​

Step 2: Add custom claims to the token

exports.onExecutePostLogin = async (event, api) => {
  const roles = event.authorization?.roles ?? [];
  api.idToken.setCustomClaim('roles', roles);
  api.accessToken.setCustomClaim('roles', roles);
};

​

Step 3: Create a Machine-to-Machine app for bulk sync (optional)

1

Create a Machine-to-Machine application

Go to Applications → Applications and click Create Application.Give it a name - e.g. Bifrost Bulk Sync - and select Machine to Machine Application.Click Create.

2

Authorize the Management API

On the next screen, select the Auth0 Management API and grant the following scopes:

• read:users
• read:user_idp_tokens
• read:roles
• read:role_members

Click Authorize.

3

Copy the M2M credentials

Open the Settings tab of your Bifrost Bulk Sync app and copy:

• Client ID
• Client Secret

​

Step 4: Configure Bifrost

1

Open User Provisioning and choose Auth0

In your Bifrost dashboard, go to Governance → User Provisioning.Select Auth0 as the identity provider and click Next.

2

Fill in the provider configuration

Enter the credentials you collected in Steps 1 and 3:

Field	Value
Domain	Your Auth0 domain, e.g. your-tenant.us.auth0.com
Client ID	From the Bifrost OIDC app Settings tab
Client Secret	From the Bifrost OIDC app Settings tab
M2M Client ID	From the Bifrost Bulk Sync app (optional)
M2M Client Secret	From the Bifrost Bulk Sync app (optional)

Click Verify & Next to confirm the connection.

3

Discover claims

On the Attribute Mapping screen, click Discover Claims.Bifrost opens a sign-in popup - no session is created. Once you authenticate, it returns the exact claims your Auth0 tenant is sending in the JWT.Confirm that the roles claim is present and contains the expected values before building your mappings.

4

Set up attribute mappings

Use the sections below the claim list to map Auth0 claim values to Bifrost roles, teams, and business units.Attribute-to-Role MappingsMap a claim value to a Bifrost role. All matching rules are evaluated. If several rules match, Bifrost picks one using your chosen resolution strategy:

• The role with the most permissions (default)
• The first matching role, by list order (drag rows to set priority)

If no rule matches, no role is assigned and login is denied.Attribute-to-Team MappingsMap a claim value to a Bifrost team. All matching rules apply.

• Use a specific value (e.g. engineering) to map that exact claim value to a named Bifrost team
• Use * as the value to sync the claim value directly as the team name
• Use ${*} to extract part of the string - e.g. Bifrost Playground: ${*} Team matches Bifrost Playground: Alpha Team and creates team Alpha

Attribute-to-Business Unit MappingsSame wildcard support as team mappings.

• Use a specific value (e.g. platform) to map that exact claim value to a named Bifrost business unit
• Use ${*} to extract a substring as the business unit name - e.g. Bifrost Playground: ${*} BU matches Bifrost Playground: Alpha BU and creates business unit Alpha
• When a rule matches, the resolved business unit is assigned to all of that user’s teams
• Manually assigned teams are left unchanged

Click Next when done.

5

Review and enable

Review your full configuration on the final screen - connection details, attribute mappings, and SCIM provisioning status - then click Save & Enable.

Restart your Bifrost server after enabling for the changes to take effect.

​

Troubleshooting