Skip to content

fix/DR-2753-update-saml-doc #854

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
BcnCarlos wants to merge 11 commits into from
Closed

fix/DR-2753-update-saml-doc #854

Changes from 7 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
040fb8f
Update sign-and-encrypt-saml-requests.mdx
BcnCarlos Mar 30, 2026
eec98f8
Update sign-and-encrypt-saml-requests.mdx
BcnCarlos Mar 30, 2026
7e2ae3a
Update sign-and-encrypt-saml-requests.mdx
BcnCarlos Mar 30, 2026
857643e
Update sign-and-encrypt-saml-requests.mdx
BcnCarlos Mar 30, 2026
03a344e
Update sign-and-encrypt-saml-requests.mdx
BcnCarlos Mar 30, 2026
63fa9a7
Update sign-and-encrypt-saml-requests.mdx
BcnCarlos Apr 9, 2026
6bea5ed
Update sign-and-encrypt-saml-requests.mdx
BcnCarlos Apr 9, 2026
81de858
Apply suggestion from @hazel-nut
BcnCarlos Apr 10, 2026
00eab17
Update main/docs/authenticate/protocols/saml/saml-sso-integrations/si…
BcnCarlos Apr 10, 2026
ac8a8cb
Update sign-and-encrypt-saml-requests.mdx
BcnCarlos Apr 10, 2026
67fdb8d
update
BcnCarlos Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 15 additions & 17 deletions ...nticate/protocols/saml/saml-sso-integrations/sign-and-encrypt-saml-requests.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,11 +215,6 @@ exports.onExecutePostLogin = async (event, api) => {
};
```






To learn how to turn the private key and certificate files into strings that you can use in a rule, see [Work with Certificates and Keys and Strings](/docs/authenticate/protocols/saml/saml-sso-integrations/work-with-certificates-and-keys-as-strings).

### Receive signed SAML authentication requests
Expand All @@ -239,16 +234,11 @@ To configure signature validation:
[...], // other settings
"signingCert": "-----BEGIN CERTIFICATE-----\nMIIC8jCCAdqgAwIBAgIJObB6jmhG0QIEMA0GCSqGSIb3DQEBBQUAMCAxHjAcBgNV\n[..all the other lines..]-----END CERTIFICATE-----\n"
}
```





```

### Send encrypted SAML authentication assertions

If Auth0 is the SAML identity provider, you can use [Actions](/docs/customize/actions) to encrypt the SAML assertions it sends.
If Auth0 is the SAML identity provider, you can use [Actions](/docs/customize/actions) to encrypt the SAML assertions it sends. You can also select the encryption algorithm used for assertion encryption. Auth0 recommends using `aes256-gcm` for a stronger security posture.

You must obtain the certificate and the public key from the service provider. If you only got the certificate, you can derive the public key using `openssl`. Assuming that the certificate file is named `certificate.pem`, you can run:

Expand All @@ -271,20 +261,28 @@ exports.onExecutePostLogin = async (event, api) => {

api.samlResponse.setEncryptionCert(encryptionCert);
api.samlResponse.setEncryptionPublicKey(encryptionPublicKey);
api.samlResponse.setEncryptionAlgorithm("aes256-gcm");
}
};
```

Auth0 supports the following algorithms for assertion encryption:

* [aes256-gcm](http://www.w3.org/2001/04/xmlenc#aes256-gcm) **(Recommended)** Authenticated encryption that provides both confidentiality and integrity. It is resistant to format validity oracle attacks.
* [aes256-cbc](http://www.w3.org/2001/04/xmlenc#aes256-cbc) Default. It does not provide integrity guarantees.
* [rsa-oaep](http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p) (including MGF1 and SHA1) used for key transport.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
When an Action does not use the object `api.samlResponse.setEncryptionAlgorithm` to set the encryption algorithm, Auth0 defaults to the `aes256-cbc` algorithm and logs a deprecation warning in your tenant logs.
</Callout>
Comment thread
BcnCarlos marked this conversation as resolved.
Outdated

<Warning>
* Auth0 intends to change the default encryption algorithm to `aes256-gcm`.
Comment thread
BcnCarlos marked this conversation as resolved.
Outdated
* Update your Action code to set the encryption to `aes256-gcm` using the object `api.samlResponse.setEncryptionAlgorithm`. This supresses the deprecation warning and ensures that your integration behaves predictably when the default algorithm changes.
* Before setting the algorithm to `aes256-gcm`, verify that your SAML service provider supports it. If it does not, contact your service provider vendor to request support.
Comment thread
BcnCarlos marked this conversation as resolved.
Outdated
</Warning>


The following algorithms are used:

* [AES256](http://www.w3.org/2001/04/xmlenc#aes256-cbc) for assertion encryption
* [RSA-OAEP](http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p) (including MGF1 and SHA1) for key transport

## Learn more

* [Work with Certificates and Keys as Strings](/docs/authenticate/protocols/saml/saml-sso-integrations/work-with-certificates-and-keys-as-strings)
Loading