> ## Documentation Index > Fetch the complete documentation index at: https://auth0-feat-docs-5613-b2b-connect.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # B2B Connect — Enterprise export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => { const stageTextMap = { "beta": "Beta", "ea": "Early Access" }; const stageText = stageTextMap[stage] || "a product release stage"; const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages"; const linkify = (text, url) => { return {text}; }; const includeDetails = (plans, contact, terms) => { const hasDetails = terms || plans || contact; if (!hasDetails) return null; return {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. } {contact && "To participate, contact " + contact + ". "} {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.} ; }; return The {feature} feature is in {linkify(stageText, prsLink)}. {includeDetails(plans, contact, terms)} ; }; Auth0 B2B Connect - Enterprise is an enterprise-ready modular integration layer that adds Auth0's B2B enterprise features (such as Single Sign-On (SSO), user provisioning using System for Cross-domain Identity Management (SCIM), and Universal Logout) to your existing authentication stack. With B2B Connect - Enterprise, you can add Auth0 B2B services on your existing authorization server and maintain control of token issuance, session management, and login while offering your B2B customers the option of using their enterprise identity provider (IdP) for user authentication. ## Benefits of B2B Connect — Enterprise Why use B2B Connect - Enterprise? Whenever you set out to build products for B2B customers, you could build complex B2B identity tooling just to handle the foundational elements of onboarding and customer management. This work typically falls to a platform identity team that balances competing priorities. The result is constant pressure to make trade-offs across three structurally critical pillars: 1. Maintain rigorous security and interoperability. 2. Deliver a flawless customer onboarding and lifecycle experience. 3. Unlock and enable innovation for your core product. When you address these pillars, you typically have the option of two paths: migrate to a modern identity platform, or layer enterprise capabilities onto your existing stack. Migration is a proven path, but it carries significant lead time. For teams in need of enterprise features on a faster timeline, or for platforms in which full migration introduces unnecessary risk, B2B Connect - Enterprise offers a third way: Add enterprise-grade B2B capabilities without replacing your existing stack. ## Use cases B2B Connect - Enterprise supports advanced B2B identity scenarios without the need for re-platforming, including the following use cases to: * Add enterprise SSO to an existing authorization server * Use self-service onboarding for your enterprise customers * Preserve your existing login experience and token issuance * Enrich application identity tokens with enterprise claims * Route users to enterprise IdPs based on verified email domain * Delegate identity administration to your B2B customers * Support IPSIE-aligned session management and Universal Logout ## How it works Auth0 B2B Connect - Enterprise sits between your application's authorization server and your customers' enterprise identity providers: ```mermaid theme={null} sequenceDiagram participant User participant Application as Your Application participant AuthServer as Your Authorization Server participant Auth0 as Auth0 B2B Connect - Enterprise participant EnterpriseIdP as Enterprise IdP Note over User,AuthServer: Step 1: Login Initiation User->>Application: Initiates login Application->>AuthServer: Sends authentication request Note over AuthServer,Auth0: Step 2: Route to Auth0 AuthServer->>AuthServer: Identifies user as B2B Connect - Enterprise user AuthServer->>Auth0: Routes authentication request Note over Auth0,EnterpriseIdP: Step 3: Enterprise IdP Federation Auth0->>EnterpriseIdP: Sends authentication request (SAML or OIDC) User->>EnterpriseIdP: Authenticates with corporate credentials EnterpriseIdP-->>Auth0: Returns SAML assertion or OIDC token Note over AuthServer,Application: Step 4: Token Issuance and Session activate AuthServer Auth0-->>AuthServer: Returns federation result AuthServer-->>Application: Issues its own token deactivate AuthServer Application->>Application: Validates token, bootstraps session Application-->>User: Grants access ``` 1. The user initiates login in your application. 2. Your application sends an authentication request to your authorization server using its existing flow. 3. Your authorization server identifies the user as a B2B Connect - Enterprise user and routes the request to Auth0. 4. Auth0 B2B Connect - Enterprise sends an authentication request to the user's enterprise IdP (such as Okta, Microsoft Entra ID, Google Workspace, or PingFederate) using SAML or OpenID Connect (OIDC). 5. The user authenticates with their corporate credentials at the enterprise IdP. 6. The enterprise IdP returns a SAML assertion or OIDC token to Auth0 B2B Connect - Enterprise. 7. Your authorization server returns its own token to your application. 8. Your application validates the token and bootstraps its own session. 9. The user is granted access to your application. For the Application integration type, the app redirects directly to Auth0, removing the intermediate authorization server from the federation flow. ## Integrate B2B Connect - Enterprise You can integrate B2B Connect - Enterprise with the Create B2B Connect Integration wizard in [Auth0 Dashboard](https://manage.auth0.com/#/b2b-integrations), which establishes the topology. Your choice at Step 1 (Name and Type) in the wizard determines your entire integration path. Create B2B Integration wizard | Type | Integration | Redirect to Auth0 from | Auth0 SDK required | Protocol | | ---- | ---------------------------------------- | ---------------------- | ------------------ | ------------ | | 1 | Custom authorization server | Auth server | Not required | OIDC or SAML | | 2 | Third-party managed authorization server | Auth server | Not required | OIDC or SAML | | 3 | Application (direct) | Application | Recommended | OIDC | ### Custom authorization server Use this type when you have built your own authorization server and it can act as a relying party to Auth0 over OIDC or SAML. Enterprise users are redirected from your auth server to Auth0; non-enterprise users remain entirely on your auth server. ``` Application → Custom Auth Server → Auth0 B2B Connect → Enterprise → Enterprise IdP ↑ | └─────── identity ────────┘ ``` In the wizard, the steps are: 1. Name and Type: Name the integration, select **Custom Authorization Server**. 2. Authentication: Select **OIDC (recommended)** or **SAML**. 3. Configure Auth0 as IdP: Provide values from your auth server so Auth0 can act as its identity provider: * OIDC: Issuer URL (expand Show individual endpoints if your auth server does not support issuer discovery to get the Authorization URL, Token URL, Client ID, and Client Secret), and your Application Callback URL. * SAML: Issuer, Identity Provider SHA1 Fingerprint, Identity Provider Login URL, Auth0 Certificate or IdP Metadata, and your Application Callback URL. 4. Integration created: Proceed to set up [Organizations](/docs/manage-users/organizations) and [Self-Service Enterprise Configuration (SSEC)](/docs/authenticate/enterprise-connections/self-service-enterprise-configuration) to onboard your first B2B customer. ### Third-party managed authorization server Use this type when you are using a purchased or managed authorization server. The topology and wizard flow are identical to Type 1. Refer to your auth server provider's documentation for configuring Auth0 as an identity provider. ``` Application → Third-party Auth Server → Auth0 B2B Connect - Enterprise → Enterprise IdP ↑ | └──────────identity ───────────┘ ``` B2B Connect - Enterprise supports third-party managed authorization servers that supports federation over OIDC or SAML. Examples include: * Amazon Cognito * PingIdentity PingOne * Ory * Keycloak * Transmit Security In the wizard, the steps are: 1. Name and Type: Name the integration, select **Third-party Managed Authorization Server**. 2. Authentication Protocol: Select OIDC (recommended) or SAML. 3. Configure Auth0 as IdP: Same OIDC or SAML field set as Type 1. Register Auth0 as the upstream identity provider in your managed auth server. 4. Integration created: Proceed to set up [Organizations](/docs/manage-users/organizations) and [SSEC](/docs/authenticate/enterprise-connections/self-service-enterprise-configuration). ### Application Use this type when your application integrates with Auth0 directly, without a separate authorization server. The application embeds the Auth0 SDK and owns the session outright. This type is OIDC only and does not include a protocol selection step. ``` Application (embeds Auth0 SDK) → Auth0 B2B Connect - Enterprise → Enterprise IdP ↑ | └──────────── identity ──────────────┘ ``` In the wizard, the steps are: 1. Name and Type: Name the integration, select **Application**. 2. Configure Integration: Enter your Allowed Callback URLs. Auth0 redirects users to these URLs after authentication. At least one URL is required. 3. Continue Setup: Integration created. Follow the Quickstart to add a Login with SSO button to your application and configure [Organizations](/docs/manage-users/organizations) and [SSEC](/docs/authenticate/enterprise-connections/self-service-enterprise-configuration). ## Configure customer onboarding Self-Service Enterprise Configuration (SSEC) gives your B2B customers a guided flow to configure their enterprise IdP and claims mappings without requiring direct support from your team. To configure customer onboarding: 1. In Auth0 Dashboard, navigate to [B2B Connect](https://manage.auth0.com/#/b2b-integrations). Under the Organizations tab, select **Set up+**. 2. Enter a name for your Self-Service Enterprise Configuration Profile. Select the Setup Tab 3. Optional. Add a description. 4. Auth0 creates a [User Attribute Profile (UAP)](/docs/authenticate/enterprise-connections/user-attribute-profile) named after your SSEC Profile. Select **Continue**. 5. Choose how you want to generate SSEC tickets: * API Integration * Auth0 Dashboard 6. Select **Done**. For information on the maximum number of SSEC profiles you can create per tenant, read [Self-Service Enterprise Configuration](https://auth0.com/docs/authenticate/enterprise-connections/self-service-enterprise-configuration#how-it-works). ## Create or configure an Auth0 Organization Once you finish the customer onboarding setup, associate an Auth0 Organization with each self-service ticket request. B2B integrations automatically use per-application access for Auth0 Organizations. This means that when a user logs in, only enterprise connections that meet both of the following conditions are surfaced: * The connection is enabled on the Organization. * The Organization has been granted access to the B2B integration application. To ensure your B2B customers can authenticate, grant each Organization access to the B2B integration application in addition to enabling its enterprise connection. ### Create a new Auth0 Organization 1. Select **+Create Organization** or for API integration instructions, select the **`<>`** for configuration details. 2. Provide a **Name** for end users. 3. Optional. Provide a **Display Name**. If omitted, the Display Name defaults to the Organization name. 4. To skip onboarding ticket creation, select Create. 5. To create an onboarding ticket for this Organization: * Select the checkbox, then select **Create and Continue**. * Add a **Connection Name** and **Display Name**. * Select **Create and Continue**. * Copy the ticket URL and share it with your B2B customer. Select **Copy and Close**. 6. Your customer administrator launches the self-service assistant via the ticket URL and follows the steps to configure their connection and complete domain verification. Generate Self-Service onboarding tickets ### Configure an existing Auth0 Organization 1. In B2B Connect - Enterprise, select the icon of the Organization you want to configure from the list. 2. Add a Connection Name and a Display Name. 3. Select Create and Continue. 4. Copy the ticket URL and share it with your B2B customer. Select Copy and Close. 5. Your customer admin launches the self-service assistant via the ticket URL and follows the steps provided to configure their connection and complete domain verification. Once setup is complete, test your configuration with a test user. ## Configure lifecycle events Use [Event Streams](/docs/customize/events) to configure real-time notifications for lifecycle events, so you can keep your downstream identity store in sync with changes in Auth0. You can subscribe to events for users, Organizations, and enterprise connections. To configure lifecycle events: 1. In Auth0 Dashboard, navigate to **[Event Streams](https://manage.auth0.com/#/event-streams)**. 2. Select **+ Create Event Stream**. 3. Choose your destination: **Webhooks**, **AWS EventBridge**, or **[Auth0 Actions](/customize/actions)**. 4. Enter your configuration and choose the event categories you want to receive: * User events: `[user.created](/docs/events/user/user.created)`, `[user.deleted](/docs/events/user/user.deleted)`, `[user.updated](/docs/events/user/user.updated)` * Organization events: `[organization.created](/docs/events/organization/organization.created)`, `[organization.deleted](/docs/events/organization/organization.deleted)`, `organization.member.*`, `[organization.updated](/docs/events/organization/organization.updated)` * Connection events: `[connection.created](/docs/events/connection/connection.created)`, `[connection.deleted](/docs/events/connection/connection.deleted)`, `[connection.updated](/docs/events/connection/connection.updated)` 5. Select **Save**. Auth0 delivers events to your Event Stream endpoint. Use these events to synchronize enterprise identity state between Auth0 and your authorization server without polling the Management API. ## Integrate Auth0 SDKs Auth0 provides SDKs for integrating B2B Connect - Enterprise into your application or authorization server. ### Supported SDKs | SDK | Language | App type | | ------------------------ | -------------------- | ----------------------- | | `@auth0/auth0-server-js` | Node.js | Regular web application | | `@auth0/nextjs-auth0` | Node.js / Next.js | Regular web application | | `express-openid-connect` | Node.js / Express | Regular web application | | `auth0-server-python` | Python | Regular web application | | `@auth0/auth0-spa-js` | JavaScript | Single-page application | | `@auth0/auth0-react` | JavaScript / React | Single-page application | | `@auth0/auth0-angular` | JavaScript / Angular | Single-page application | | `@auth0/auth0-vue` | JavaScript / Vue | Single-page application | Quickstarts for each SDK are available in the **Quickstart** tab of your B2B Integration. ### Integration pattern B2B Connect - Enterprise uses a stateless passthrough model. Auth0 handles the SSO round trip to the enterprise IdP and returns an enriched ID Token; your existing authorization server or application remains the session authority. This differs from a standard Auth0 integration in several ways: * Stateless mode: Server SDKs omit the session store (`stateStore` / `state_store`). The callback method (`completeInteractiveLogin` / `complete_interactive_login`) returns user claims and the ID token directly. Read identity from the return value rather than getSession(). * No refresh token: B2B Connect - Enterprise does not issue refresh tokens. Set `scope` to `openid profile email` and omit `offline_access`. * Organization required: Pass `organization` to `/authorize` to bind the login to the correct Auth0 Organization and enable silent passthrough to the enterprise IdP. Validate the org\_id claim in the returned token before trusting the login. * Federated logout: When logging out, redirect to Auth0's `/v2/logout` with `federated: true` to terminate the enterprise IdP session. Without this, the IdP session stays active. ### Login with SSO Use `loginWithRedirect` (SPA SDKs) or `startInteractiveLogin` (server SDKs) to initiate the authentication flow. Pass `login_hint` (the user's email), `connection`, and `organization` in `authorizationParams`. Quickstarts in the **Quickstart** tab provide complete integration instructions for each SDK. ### Domain-based user routing (Webfinger). B2B Connect - Enterprise exposes a standard Webfinger endpoint you can use to detect whether a user's email domain is managed by Auth0. Before using the Webfinger endpoint, the tenant admin must enable the Local Resource Discovery flag. Navigate to [**Tenant Settings > Advanced**](https://manage.auth0.com/#/tenant/advanced) and enable Local Resource Discovery. Tenant Settings > Advanced > Settings > Local Resource Discovery toggle ```curl theme={null} GET https://{your-auth0-domain}/.well-known/webfinger ?resource=urn:auth0:discovery:domain:{user-domain} &rel=http://openid.net/specs/connect/1.0/issuer ``` If the user's email domain is registered with an Auth0 Organization and enterprise connection, the endpoint returns the Auth0 issuer. If not, fall back to your existing authentication path. Auth0 also provides a domain lookup SDK that wraps this endpoint as a convenience: ``` ``` const result = await auth0EC.lookupDomain('[user@acme.com](mailto:user@acme.com)'); if (result.managed) else \`\`\` ``` #### Recommended routing approach Once Webfinger confirms the user is Auth0-managed, pass only the user's email as login_hint to Auth0. You do not need to maintain your own domain-to-organization or domain-to-connection mapping — Auth0 handles Home Realm Discovery from the login_hint using the Organization and domain configuration set up during onboarding. Auth0 then routes the user silently to their enterprise IdP. There are two scenarios depending on how many connections are enabled for the Organization: * One connection enabled: Auth0 performs org-level HRD using the email domain and routes the user directly to the enterprise IdP. No additional configuration is required. * Multiple connections enabled: Auth0 performs org-level HRD followed by connection-level HRD. This requires [Identifier First](/docs/authenticate/login/auth0-universal-login/identifier-first) to be enabled on your tenant so Auth0 can determine the correct connection without prompting the user. The B2B integration wizard configures your client with the organization and domain settings required for this to work automatically. For details on how login flows work with Organizations, read [Login flows for Organizations](). ```