markyardExplore the docs

Single sign-on

Set up Auth0 SSO for Markyard

This guide is for Auth0 administrators who are connecting their organization to Markyard.

Customer guideIdentity administrator

Each Markyard hosting uses one identity provider. Follow this guide when Auth0 is the identity provider selected for your hosting.

Before you begin

Ask your Markyard administrator for:

  • your Markyard URL, such as https://markyard.example.com;
  • the callback URL for your hosting; and
  • the logout return URL for your hosting.

For a hosting at https://markyard.example.com, the values are:

Purpose URL
Callback https://markyard.example.com/api/auth/callback/auth0
Logout return https://markyard.example.com/login

You also need permission to create or manage applications in your Auth0 tenant.

1. Create the Auth0 application

  1. Sign in to the Auth0 Dashboard.
  2. Go to Applications > Applications.
  3. Select Create Application.
  4. Name the application Markyard.
  5. Select Regular Web Applications.
  6. Create the application and open its Settings page.

2. Add the Markyard URLs

Under Application URIs, enter the exact URLs supplied for your hosting:

Auth0 setting Value
Allowed Callback URLs Your Markyard callback URL
Allowed Logout URLs Your Markyard logout return URL

Use exact URLs without wildcards, then save the application settings.

3. Choose who can sign in

Markyard accepts users whom Auth0 successfully authenticates for this application. Review access before enabling SSO:

  1. Open the application's Connections settings.
  2. Enable only the enterprise or database connections that should access Markyard.
  3. If you use an Auth0 database connection, disable public sign-up unless every self-registered user should receive Markyard access.
  4. Apply your organization's required MFA and sign-in policies.

Auth0 users must have a verified email address to sign in to Markyard.

4. Send the application details to your Markyard administrator

From the application's Settings and Credentials pages, collect:

  • Domain;
  • Client ID; and
  • Client Secret.

Send these values to your Markyard administrator through your approved secure channel. Do not send the client secret through ordinary email or chat, and do not place it in a ticket visible to unauthorized people.

If you operate the AWS hosting, continue with Create the Auth0 application secret for AWS before deploying Markyard.

5. Verify sign-in

After your Markyard administrator confirms that the connection is ready:

  1. Open your Markyard URL.
  2. Select Continue with Auth0.
  3. Sign in with an authorized Auth0 account.
  4. Confirm that Markyard opens after authentication.
  5. Sign out and confirm that Auth0 returns you to the Markyard login page.

Also test an account that should not have access.

Manage access

  • Grant or remove access through the Auth0 connections and policies enabled for the Markyard application.
  • Review enabled connections periodically so there are no unintended sign-in paths.
  • Removing access in Auth0 prevents the user's next Auth0 sign-in. Ask your Markyard administrator to end an existing Markyard session when immediate removal is required.

Rotate the client secret

Coordinate secret rotation with your Markyard administrator to avoid a sign-in interruption:

  1. Agree on a maintenance window.
  2. Rotate the client secret in the Auth0 application.
  3. Copy the new secret from Credentials.
  4. Transfer the new value through your approved secure channel.
  5. Ask your Markyard administrator to confirm browser sign-in.

Auth0 notes that a newly rotated secret can take up to 30 seconds to become available.

Troubleshooting

Auth0 reports a callback URL mismatch

Compare Allowed Callback URLs with the callback supplied by your Markyard administrator. The scheme, hostname, port, and path must match exactly.

Sign-in reaches Markyard but does not complete

Confirm that:

  • the user signs in through a connection enabled for the Markyard application;
  • the user's Auth0 profile contains a verified email address; and
  • the application credentials supplied to the Markyard administrator are current.

Logout does not return to Markyard

Confirm that the exact Markyard logout return URL is listed under Allowed Logout URLs.

Auth0 references