Enable SSO using Auth0 in AnyPoint Platform

AnyPoint Platform: Sign In. Enter your username or password.
JD: Here you go!
AnyPoint Platform: [ERROR] Incorrect username or password.
JD: Let me try another one!
AnyPoint Platform: [ERROR] Incorrect username or password.
JD: Ahhh! So many credentials to remember. 
    Why can't it have just SSO tied to it?
JD: Let's enable...
    ███████╗███████╗ ██████╗
    ██╔════╝██╔════╝██╔═══██╗
    ███████╗███████╗██║   ██║
    ╚════██║╚════██║██║   ██║
    ███████║███████║╚██████╔╝
    ╚══════╝╚══════╝ ╚═════╝

Single sign-on (SSO) is an identification method that enables users to log in to multiple applications and websites with one set of credentials. SSO streamlines the authentication process for users.

No more remembering of credentials for different applications/websites.

There are many SSO providers available in the market with various offerings. For example: Okta, Microsoft Entra ID, Auth0, etc.

For this blog, we will be using Auth0 for configuring SSO in AnyPoint Platform.

Auth0: Single Sign-On (SSO) lets users authenticate once and access all applications in the same tenant without re-entering credentials.

Let’s enable SSO on AnyPoint Platform using Auth0 Provider.

SETUP TIME

Outline

• Auth0 Configurations
  • Login to Auth0
  • Create Connections
  • Create Application
  • SSO
  • User Management
• AnyPoint Platform
  • Identity Providers
• Moment of truth
  • Sign in
  • Sign out
• Fix
• Resources

Auth0 Configurations

Login to Auth0

1. Login to auth0 with your credentials. If you do not have an account, create a new account.

Create Connections

1. Navigate to Auth0 Dashboard > Authentication.
2. Select a connection type: (Database, Social, Enterprise, Passwordless)
3. For simplicity, use the Database as the connection type.
4. Click on + Create DB Connection.
5. Enter a name for the database connection, e.g. AnyPoint-Platform.
6. Enable Email Address and username as user identifier.
7. Click on Create. A database connection will be created.
8. Toggle Disable Sign-Ups to disable anyone from signing up. This will allow only admins to manage users.

Create Application

1. Under Applications, click on Applications. Then click on + Create Application.
2. Enter the application name(e.g. Login Screen). Select Single Page Application. Click on Create
3. Under Connections, enable the connection created in the Create Connections section.
4. Under Addons. Click on SAML2 WEBAPP.
5. Click on Download in front of Identity Provider Metadata:
6. With this metadata, configure the IdP in Anypoint Platform.
7. Fetch the ACS URL and use it under settings for SAML2 WEBAPP. Save the configuration to enable SAML2 WEBAPP.

SSO

1. Under Applications, click on SSO Integrations. Then click on + Create SSO Integration.
2. Search and select “AnyPoint”.
3. Click Continue.
4. Under General, Enter the Name (e.g. AnyPoint-Platform).
5. Enter the ACS URL in the format below. Take the URL from the provider created in AnyPoint Platform.

https://anypoint.mulesoft.com/accounts/login/{organization}/providers/{id}/receive-id

6. Enter the Audience URL in the format below.

https://{domain}.anypoint.mulesoft.com

Replace {organization}, {domain} with the information from AnyPoint Platform. You can find these details by going to Access Management > Business Groups > Your Org

7. Click on Save.

User Management

To add users in Auth0.

1. Click on User Management. Click on Users.
2. Click on + Create User.
3. Click on Create via JSON.
4. Select the Connection created in Create Connections section e.g. AnyPoint-Platform.
5. Paste the below JSON by updating with relevant user information. Click on Create.

{
    "email": "johndoe@example.com",
    "family_name": "Doe",
    "given_name": "John",
    "name": "John Doe",
    "username": "j_doe",
    "password":"SecurePassword"
}

The user will be added to the connection and can be used to login to Auth0.

AnyPoint Platform

Let’s add the final piece to the puzzle and configure changes on AnyPoint Platform.

Identity Providers

1. Log in to AnyPoint platform
2. Click on Access Management.
3. Click on Identity Providers.
4. Click on Add Identity Provider
5. Specify name “Auth0”.
6. Click on Choose File under Import IdP metadata. Use the file downloaded in the Create Application
7. Under Audience, enter the Audience URL in the format below.

https://{domain}.anypoint.mulesoft.com

8. Click on Save Changes.
9. Click on the Auth0 provider. Copy the ACS URL; this will be used to configure the SSO in Auth0.
10. Click on the Adavanced Settings. Update the Attributes as below.

Now, configuration is done. The moment of truth. Let’s test it.

Moment of truth

Sign in

• Login using the below url.

https://anypoint.mulesoft.com/login/domain/{domain}

Update {domain} with the domain of the AnyPoint Platform.

• Click on Continue with Auth0.

• Enter your Auth0 credentials, configured during the user creation. Click Continue.

Sign out

• Click on user icon on the top right corner. Click |-> Sign Out.

missing client.addons.samlp.logout.callback

This wasn’t smooth… Sign in is working but Sign out is giving issues.

Fix

1. Add the below configurations in Application. Go to Addons and then SAML2 WEB APP.
2. Update the settings with the below JSON by updating {domain}.

{
  "nameIdentifierProbes":[
    "http://schemas.auth0.com/username"
  ],
  "logout": {
    "callback": "https://anypoint.mulesoft.com/accounts/logout/receive-id?redirect_uri=https%3A%2F%2Fanypoint.mulesoft.com%2Faccounts%2Flogin%2F{domain}",
    "slo_enabled": true
  }
}

3. Click on Save.
4. Now perform the Sign-Out.

IT WORKS!!!

Resources

• https://auth0.com/docs/authenticate/identity-providers/view-connections
• https://auth0.com/docs/authenticate/database-connections
• https://docs.mulesoft.com/access-management/conf-saml-sso
• https://www.samltool.io/
• https://www.fortinet.com/resources/cyberglossary/single-sign-on

Please share your valuable feedback 😄😄😄!!!