> ## Documentation Index
> Fetch the complete documentation index at: https://wundergraphinc-brendan-add-external-directive.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth0

> Setting up SSO with Auth0

### Steps to set Auth0 as an OIDC identity provider

<Steps>
  <Step>
    Navigate to the Applications view within your Auth0 account.
  </Step>

  <Step>
    Either use the default application or create a new application by clicking on the **Create Application** button.
  </Step>

  <Step>
    A dialog will open, give the app a name, select the type of application and then click on the **Create** button.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-14.png" />
    </Frame>
  </Step>

  <Step>
    Once the app is created, navigate to the Setting tab. Now copy the **Domain**, **Client ID** and **Client Secret**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-15.png" />
    </Frame>
  </Step>

  <Step>
    Navigate to the settings page on Cosmo.
  </Step>

  <Step>
    * Click on **Connect.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect_oidc.png" />
    </Frame>
  </Step>

  <Step>
    Give the connection a name, the **Discovery Endpoint** will be  `https://YOUR_AUTH0_DOMAIN/.well-known/openid-configuration` **,** and paste the **Client ID** and  **Client secret**copied before into the **Client ID** and  **Client Secret fields respectively,**and then click on **Connect.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect-oidc-dialog.png" />
    </Frame>
  </Step>

  <Step>
    Configure the mapping between the roles in Cosmo and the user roles in Auth0. The field **Group in the provider** can be populated with the name of the role or a regex to match the user roles. Once all the mappers are configured, click on **Save**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/map-oidc-groups.png" />
    </Frame>
  </Step>

  <Step>
    Copy the sign-in and sign-out redirect URIs displayed in the dialog.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect-oidc-success.png" />
    </Frame>
  </Step>

  <Step>
    Navigate back to the settings tab of the application created on Auth0 and populate the **Allowed Callback URLs** and **Allowed Logout URLs** redirect URIs with the above-copied sign-in and sign-out URLs respectively. Click on **Save Changes**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-20.png" />
    </Frame>
  </Step>

  <Step>
    Now navigate to **Actions** -> **Library,** and then click on  **the Build Custom**button**.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-21.png" />
    </Frame>
  </Step>

  <Step>
    Give the action a name, select **Login/Post Login** as the **Trigger** and **Node 18** as the **Runtime** and then click the  **Create**button**.**
  </Step>

  <Step>
    Copy the below code and paste it into the editor shown, then click the **Deploy** button.

    ```js
    exports.onExecutePostLogin = async (event, api) => {
      if(event.authorization){
        api.idToken.setCustomClaim(`ssoGroups`, event.authorization.roles);
      }
    };
    ```
  </Step>

  <Step>
    Now navigate to **Actions** -> **Flows,** and then click on  the  **Login**flow**.**
  </Step>

  <Step>
    Navigate to the **Custom** tab on the right side of the page. Now drag the action and place it between Start and Complete as shown below, and then click on **Apply**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-22.png" />
    </Frame>
  </Step>

  <Step>
    Now you can assign users/groups to the application, and those users will be able to log into Cosmo using the URL provided on setting up the provider.
  </Step>
</Steps>