This guide walks Sequel customers through configuring SSO as the SAML Identity Provider (IdP). It mirrors our Okta and Azure AD guides and uses the same attribute mappings.
Who is this for?
IT admins who manage SAML and want their users to sign in to Sequel with SSO.
What you’ll need
An admin account with access to User Authentication → SSO Applications.
Your Sequel SSO contact or support thread so we can exchange metadata.
Your Auth0 tenant details (we’ll provide):
Auth0 Domain:
https://DOMAIN/ACS URL:
https://DOMAIN/login/callback?connection=CONNECTION_NAMEEntity ID:
urn:auth0:TENANT:CONNECTION_NAME
⚠️ Replace placeholders with the values we provide.
Step 1 — Configure your SSO Application
In Admin account , go to User Authentication → SSO Applications → + Add New Application or a similar path depending on your provider.
Choose Custom SAML and click Configure.
Fill in:
Display Label:
Sequel SSOSP Entity ID:
urn:auth0:YOUR_TENANT:YOUR_CONNECTION_NAMEACS URL:
https://YOUR_AUTH0_DOMAIN/login/callback?connection=YOUR_CONNECTION_NAMENameID:
EmailAddress(email format)Signature Algorithm: RSA-SHA256
Attributes:
email→user.emailgiven_name→user.firstnamefamily_name→user.lastnamename→user.displayname
Save and download the IdP Certificate.
Note the IdP Login URL and IdP Entity ID.
Assign users/groups who need access.
Step 2 — Share with Sequel
Provide Sequel with:
IdP Login URL
IdP Sign Out URL (if different)
IdP Entity ID
X.509 Certificate
Email domain(s) to allow
Sequel will finalize the Auth0 connection.
Attribute Reference
Attribute | Required | Example | Notes |
| ✅ | Unique ID | |
| ✅ | Alice | First name |
| ✅ | Lee | Last name |
| ✅ | Alice Lee | Display name |
Common Errors
unauthorized_client→ Check ACS URL and enabled connection.Missing attributes → Verify attribute mappings.
Invalid signature → Re-upload IdP certificate.
Clock skew → Sync server clocks.
Security Notes
Enable Signed Assertions.
Encryption optional, signing required.
Limit user/group access.
Need help?
Email support@sequel.io with:
Error message + timestamp
IdP Issuer + SSO URL
Redacted SAML response (if available)
