Configure Auth0 Authentication

Overview

EMS uses Auth0 as a centralized identity broker for single sign-on (SSO). Auth0 integrates with your organization's identity provider (IdP) using SAML 2.0 or OpenID Connect (OIDC).

The onboarding process uses a secure, time-limited self-service configuration link that allows your identity team to connect your IdP directly to your EMS tenant.

			+------------------+         +------------------+         +------------------+
			|  Enterprise IdP  | <=====> |   Auth0 Broker   | <=====> |  EMS |
			| (Entra, Okta,    |  SAML   | (Accruent Cloud) |  Token  | (Web Application)|
			|  Shibboleth)     |         |                  |         |                  |
			+------------------+         +------------------+         +------------------+

Prerequisites

Before you begin, verify the following requirements.

Administrative privileges

You must have access to your enterprise IdP and permission to create enterprise applications or relying party trusts.

EMS user account requirements

  • Users must already exist in EMS.
  • The email address in EMS must exactly match the email address or UPN sent by the IdP.
  • Users must have appropriate EMS administrative permissions.

Environment separation

Accruent provides separate configuration links for staging and production environments. Configure and validate the staging environment before configuring production.

Request a self-service setup link

To initiate Auth0 integration, provide the following information to your Accruent implementation specialist or support representative:

  • Primary email domain or domains
  • Identity provider type
  • Name and email address of the technical contact responsible for configuration

Accruent provides a unique self-service setup link to the designated technical contact.

Warning: Self-service setup links expire seven days after creation and are valid only for the designated tenant connection. Contact Accruent Support if the link expires.

Complete the self-service configuration

  1. Open the self-service setup link.

  2. Review the prepopulated connection information.

  3. Select a configuration method.

Method A: Configure using a metadata URL

Use this method when your IdP provides a publicly accessible SAML federation metadata endpoint.

  1. Select Sign In URL / Metadata URL.

  2. Paste the federation metadata URL from your IdP.

  3. Select Fetch Metadata.

    Auth0 retrieves the SSO URL, Entity ID, and signing certificates.

  4. Select Save and Test.

Method B: Configure manually

Use this method when metadata is unavailable or your IdP requires manual configuration.

  1. Select Manual Setup.

  2. Enter the IdP SAML endpoint in Sign In URL / SSO URL.

  3. Optional: Enter the logout endpoint in Sign Out URL.

  4. Enter the IdP identifier in Entity ID / Issuer.

  5. Upload the IdP signing certificate in Upload Certificate.

Configure service provider settings

Configure the following values in your identity provider.

IdP configuration field Value Notes
ACS URL (Single Sign-On URL) https://auth.accruent.com/login/callback?connection={YOUR_CONNECTION_NAME} Displayed in the self-service portal.
Audience URI / SP Entity ID urn:auth0:accruent-prod:{YOUR_CONNECTION_NAME} Unique tenant identifier.
SAML Binding HTTP-POST Recommended binding.
NameID Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress or persistent Must resolve to a valid user email address.

Configure SAML claims

EMS matches authenticated users to EMS user records using SAML assertion attributes.

Required claims

Claim Description Example
email User email address used for EMS account matching. mail or emailaddress claim
user_id / nameidentifier Persistent unique user identifier. nameidentifier claim

Recommended claims

Claim Description
given_name User first name.
family_name User last name.
name User display name.

Microsoft Entra ID configuration

  1. Open the Microsoft Entra admin center.

  2. Navigate to Enterprise Applications > New Application > Create your own application.

  3. Select Integrate any other application you don't find in the gallery (Non-gallery).

  4. Navigate to Single sign-on > SAML.

  5. Configure the Entity ID and Reply URL values provided by the self-service portal.

  6. Verify that email claims map to the user's email address.

Shibboleth configuration example

Add the Auth0 service provider metadata to your Shibboleth configuration.

			<bean parent="RelyingPartyByName" 
			c:relyingPartyIds="urn:auth0:accruent-prod:YOUR_CONNECTION_NAME">
			<property name="profileConfigurations">
			<list>
			<bean parent="SAML2.SSO.MDDriven" />
			</list>
			</property>
			</bean>

Configure attribute release rules as required.

			<AttributeFilterPolicy id="releaseToAccruentEMS">
			<PolicyRequirementRule xsi:type="Requester"
			value="urn:auth0:accruent-prod:YOUR_CONNECTION_NAME" />
			<AttributeRule attributeID="mail" permitAny="true" />
			<AttributeRule attributeID="givenName" permitAny="true" />
			<AttributeRule attributeID="sn" permitAny="true" />
			</AttributeFilterPolicy>

Okta configuration

  1. Navigate to Applications > Applications > Create App Integration.

  2. Select SAML 2.0.

  3. Enter the ACS URL and Audience URI values provided by the self-service portal.

  4. Configure the Name ID format as EmailAddress.

  5. Configure attribute mappings for email, given name, and family name.

Test the connection

  1. Select Test Connection or Try Connection.

  2. Authenticate using your organization's identity provider.

  3. Review the returned SAML assertion attributes.

  4. Verify that authentication completes successfully and that the email attribute matches an EMS administrator account.

  5. Notify your Accruent representative after successful validation.

Troubleshooting

Issue Possible cause Resolution
User account not found No matching EMS user account exists. Verify that the EMS user email matches the email claim returned by the identity provider.
Access denied or blank dashboard User lacks EMS permissions. Assign the user to an EMS user group with proper permissions.
Invalid SAML response or signature verification failed The certificate configured in Auth0 does not match the IdP signing certificate. Upload the current IdP signing certificate.
Link expired The setup link expired after seven days. Request a new self-service setup link.
Repeated redirection to the login page Clock skew between systems. Synchronize the identity provider system clock using NTP.

Additional resources

For information about EMS user provisioning and security configuration, see the EMS System Administration Guide.

For support, contact your Accruent implementation team or use the Accruent Customer Center.