Configuring Liferay Authentication With Auth0 Using OpenId Connect

This tutorial guides you through integrating Auth0, your Identity Provider (IdP), with your Liferay environment using OpenID Connect.

Prerequisites

• Auth0 account
• Liferay DXP environment
• A user who has administrative access to Auth0’s dashboard
• A user who has administrative access to Liferay’s Control Panel
• Auth0 users with first and last name populated in their Auth0 profiles

Auth0 Configuration

1. Log in to Auth0.

2. Open Auth0’s dashboard

3. Select Applications from the side menu and create a new application.

   

4. Set a name of your choice, and choose Regular Web Applications for your application type.

   

5. Click Create to have your application ready.

6. The Client ID and Client Secret can be found in the Settings tab. You’ll need them later on.

   

7. Scroll down to the Application URIs section to set the Allowed Callback URLs field, and enter https://[your_liferay_environment]/c/portal/login/openidconnect.

   

8. Access the Advanced Settings at the bottom of the page to edit any additional settings.

9. Click Save Changes to save your application settings.

10. With the Auth0 configuration complete, you can now configure your Auth0 application to Liferay DXP.

Note

If you are testing and do not have any users, create them by navigating to User Management → Users in the Auth0 dashboard. Each user must have their first and last name set in their Auth0 profile — Auth0 returns these as the given_name and family_name claims (pieces of user information Auth0 sends to Liferay during sign-in), which Liferay requires to create user accounts.

Configuring the OpenID Connect Provider Connection

Now that Auth0 is configured, use Liferay’s interface to set up the provider connection. All configuration is done through the provider’s Well-Known Configuration Endpoint.

Note

The Auth0’s Well-Known URI is https://[your-default-tenant].us.auth0.com/.well-known/openid-configuration. To find your default tenant, navigate to your profile and look for Default Tenant, or on the url before /profile.

1. On your DXP instance, navigate to Global Menu → Control Panel → Instance Settings → Security → SSO.

2. Go to OpenID Connect Provider Connection tab and add a new connection entry.

3. Fill out the fields with the requested data as shown in the table below. For all fields except Scopes, use values from the Well-Known URL noted above. Enter the Scopes value exactly as shown.

   Note

   The Scopes value (openid email profile) is a fixed string — it is not found in the Well-Known URL.

   Field	Data
   Provider Name	Auth0 OIDC
   Scopes	openid email profile
   Authorization Endpoint	authorization_endpoint url
   Issuer URL	issuer url
   JWKS URI	jwks_uri url
   ID Token Signing Algorithms	id_token_signing_alg_values_supported url
   Subject Types	subject_types_supported url
   Token Endpoint	token_endpoint url
   User Information Endpoint	userinfo_endpoint url
   OpenID Connect Client ID	Under the Settings tab of your application in Auth0
   OpenID Connect Client Secret	Under the Settings tab of your application in Auth0

Important

The profile scope is required. Liferay maps the given_name and family_name claims from Auth0 to the user’s first and last name. If these claims are missing from the token when a new user account is being created, authentication fails with a mapping error. Auth0 only returns them when the profile scope is requested and the user’s Auth0 profile has those fields populated — see Missing first or last name for details.

Be sure to click Save to ensure your changes are preserved.

Once that is done, enable OpenID Connect. To enable the OpenId Connect:

1. On your DXP instance, navigate to Global Menu → Control Panel → Configuration → Instance Settings.

2. Click on SSO under the security section.

3. Go to the OpenID Connect tab, click the Enabled checkbox and click Save.

   

Validation

1. Start your Liferay DXP instance

2. Click on the Sign In button and choose OpenId Connect.

   

3. Choose Auth0 OIDC from the list and sign in with your Auth0 account.

   

4. Once you click Sign In, you’ll be redirected to Auth0’s log in page.

   

5. Type in the email address and password for your user. You have successfully logged in.

6. Sign back in with your Liferay administrator account. Navigate to Control Panel → Users and Organizations, and verify that the account came into Liferay.

Conclusion

Congratulations! Users may now authenticate to your environment by using Auth0.

Tips and Troubleshooting

Callback URL mismatch

If you encounter an error like the image below, verify that your Allowed Callback URLs are configured correctly in Auth0 with the appropriate path and Hypertext Transfer Protocol (HTTP or HTTPS). You can find them in your Auth0 account by navigating to the application you created → Settings tab → Application URIs section.

Missing first or last name

If authentication fails with a message about a missing first or last name, Auth0 is not returning the given_name or family_name claims in the token. There are two common causes:

• The profile scope is not included. Verify that the Scopes field in the OpenID Connect Provider Connection is set to openid email profile.
• The user’s Auth0 profile is incomplete. The profile scope only returns given_name and family_name if those fields are populated in Auth0. To set them, navigate to User Management → Users in the Auth0 dashboard, open the user, and update the First Name and Last Name fields. For programmatic updates (requires API credentials and developer access), see the Auth0 Management API.

After applying either fix, retry the sign-in flow. To confirm the account was created, navigate to Control Panel → Users and Organizations in Liferay DXP.