The Admin Portal manages Single Sign-On (SSO) via Auth0, which simplifies the authentication process for our clients and allows us to integrate via a variety of SSO providers.

Overview

Auth0 allows us to create enterprise connections, which enable users to log in using their company's identity provider (IdP).

Currently, we support all enterprise connection methods supported by Auth0, the two most popular ones being SAML and OIDC. Both of which are very easy to set up.

Role Mapping

There are five roles available for user mapping:

---

Connection Setup

SAML

Information We Provide

PayMitto will provide the following details for both sandbox and production environments:

Information We Receive

Customers will provide:

• A login URL
• An x509 certificate These are used to create the enterprise connection in Auth0.

---

OIDC

Information We Receive

Customers provide an OIDC discovery URL. We use this to create the enterprise connection and then inspect the JSON response from the URL to determine whether the requested scopes need to be updated to include the scope for the user role.

Information We Provide

Provide the customer with the following details for both sandbox and production environments:

Note: The Reply URL for OIDC does not require a connection query parameter.

Creating and assigning roles in Entra

First, ensure the roles have been created in Entra -> App Registrations -> [the application] -> Manage -> App Roles:

Create each role with a name and description of your choosing, allowed member type of Users/Groups, and the values above

Then, go to Entra -> Enterprise Applications ->  [the app] -> Manage -> Users and Groups -> Add user/group -> Select the appropriate group, and select the role you just created