> ## Documentation Index
> Fetch the complete documentation index at: https://docs.edplay.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Configuration with Auth0 and SAML2

> Set up Single Sign-On for your Edplay Enterprise workspace using Auth0 as your SAML2 identity provider in a few straightforward steps.

This guide walks you through configuring Single Sign-On (SSO) for your Edplay Enterprise workspace using Auth0 as an example SAML2 identity provider. After you complete these steps, employees will be able to log in through your identity provider and have their profiles, roles, and course access synced automatically.

<Note>
  The Assertion Consumer Service URL and SSO settings are only available in **Enterprise workspaces**.
</Note>

<Steps>
  <Step title="Create an Auth0 account">
    Go to the [Auth0 website](https://auth0.com) and create a new account.
  </Step>

  <Step title="Create a Regular Web Application">
    In Auth0, open **Applications** > **Create Application**. Enter a name, select **Regular Web Application**, and save.
  </Step>

  <Step title="Open the application Addons">
    Open the newly created application and navigate to the **Addons** page.
  </Step>

  <Step title="Enable SAML2 WEB APP">
    Enable the **SAML2 WEB APP** toggle and switch to the **Settings** tab.
  </Step>

  <Step title="Enter the Assertion Consumer Service URL">
    In the **Name** field, enter the Assertion Consumer Service URL. You can find this in the Edplay portal:

    **Workspace Settings** > **Security** > enable the **Single Sign On** toggle.
  </Step>

  <Step title="Edit the JSON config">
    Edit the JSON config and paste a configuration similar to the following. Make sure your JSON includes three mapping options: `email`, `name`, and `role`.

    ```json theme={null}
    {
      "audience": "https://auth.edplay.ai/saml/1394/metadata",
      "recipient": "https://auth.edplay.ai/saml/1394/acs",
      "destination": "https://auth.edplay.ai/saml/1394/acs",

      "mappings": {
        "email": "user.email",
        "name": "user.name",
        "role": "user.app_metadata.role"
      },

      "passthroughClaimsWithNoMapping": false,
      "mapUnknownClaimsAsIs": false,

      "typedAttributes": false,
      "includeAttributeNameFormat": false,

      "signatureAlgorithm": "rsa-sha256",
      "digestAlgorithm": "sha256",
      "lifetimeInSeconds": 3600,
      "signResponse": true,

      "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
      "nameIdentifierProbes": ["email"]
    }
    ```

    Click **Save**. You should see a green success message.
  </Step>

  <Step title="Copy the Identity Provider Login URL">
    On the same page, open the **Usage** tab. Copy the **Identity Provider Login URL** (the base domain only, for example `https://dev-bxbohzebk6yfmnsa.us.auth0.com/`) and paste it into the Edplay portal's **IDP Entity ID** field.
  </Step>

  <Step title="Enter the IDP Service Location">
    In the **IDP Service Location** field, enter the full URL. For example:

    `https://dev-bxbohzebk6yfmnsa.us.auth0.com/samlp/ujE4HtX0VZvyLefpbnLCxvi5pnnVDR49`
  </Step>

  <Step title="Enter the IDP SLO Endpoint">
    In the **IDP SLO Endpoint** field, paste the logout URL. For example:

    `https://dev-bxbohzebk6yfmnsa.us.auth0.com/v2/logout`
  </Step>

  <Step title="Download the Identity Provider Certificate">
    In Auth0, download the **Identity Provider Certificate**. Open the file in a text editor and copy the full script content.
  </Step>

  <Step title="Paste the certificate into Edplay">
    In your Edplay workspace settings, paste the copied certificate script into the **IDP Certificate** field.
  </Step>

  <Step title="Enable SSO and save">
    Enable the **Allow** checkbox and click **Save changes**.
  </Step>
</Steps>

Next: [How to set up Data Mapping](/sso/data-mapping)